34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 98:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T534,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win32_Qihoo360_K_potentially_unwanted_application Sample d99eb978d6c2… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d99eb978d6c2…. Malware family: Win32_Qihoo360_K_potentially_unwanted_application. Threat score 100/100. 6/24 AV engines flagged this file. 10 malicious and 27 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","keywords":["Malicious","Win32_Qihoo360_K_potentially_unwanted_application","malware analysis","sandbox report","threat intelligence","d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18"],"about":{"@type":"SoftwareApplication","name":"setup360压缩_100100507_4001959_csMNFx8p.exe","applicationCategory":["peexe","executable"],"identifier":"d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win32_Qihoo360_K_potentially_unwanted_application","antivirusDetections":{"malicious":6,"total":24},"behavioralIndicators":{"malicious":10,"suspicious":27},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:Ta8f,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp")37:T4d0,Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "NtSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp")38:T432,"setup360__100100507_4001959_csMNFx8p.exe" called "LoadResource with parameter {'hModule': '57081857', 'hResInfo': '68780608'}" (UID: 00000000-00005696) "setup360__100100507_4001959_csMNFx8p.exe" called "LoadResource with parameter {'hModule': '3997696', 'hResInfo': '4891376'}" (UID: 00000000-00005696) "setup360__100100507_4001959_csMNFx8p.exe" called "LoadResource with parameter {'hModule': '3997696', 'hResInfo': '4891344'}" (UID: 00000000-00005696) "setup360__100100507_4001959_csMNFx8p.exe" called "LoadResource with parameter {'hModule': '3997696', 'hResInfo': '4891360'}" (UID: 00000000-00005696) "setup360__100100507_4001959_csMNFx8p.exe" called "LoadResource with parameter {'hModule': '3997696', 'hResInfo': '4891392'}" (UID: 00000000-00005696) "setup360__100100507_4001959_csMNFx8p.exe" called "LoadResource with parameter {'hModule': '135069697', 'hResInfo': '146768448'}" (UID: 00000000-00005696) "setup360__100100507_4001959_csMNFx8p.exe" called "LoadResource with parameter {'hModule': '1930559488', 'hResInfo': '1931835592'}" (UID: 00000000-00005696)39:T949,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp")3a:T78e,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp")3b:T49c,Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "BRegSetValueExW" (Indicator: "RegSetValue"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "BRegSetValueEx" (Indicator: "RegSetValue"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "RegFlushKey" (Indicator: "RegFlushKey"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "BRegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "BRegSetValueEx" (Indicator: "RegSetValue"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "RegFlushKey" (Indicator: "RegFlushKey"; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp")3c:Td6b,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found string "@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found string "@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string "@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string "@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp")3d:T4fa,Found reference to "CALG_HMAC" (Indicator: "HMAC"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to "CALG_RC2" (Indicator: "RC2"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to "CALG_HMAC" (Indicator: "HMAC"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to "CALG_RC2" (Indicator: "RC2"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to "TLS_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00005696.00000000.158764.00A20000.00000004.mdmp, 00000000-00005696.00000001.160683.00A20000.00000004.mdmp, 00000000-00005696.00000002.162605.00A20000.00000004.mdmp") Found reference to "HKDF" (Indicator: "HKDF"; Source: "00000000-00005696.00000000.158764.00A20000.00000004.mdmp, 00000000-00005696.00000001.160683.00A20000.00000004.mdmp, 00000000-00005696.00000002.162605.00A20000.00000004.mdmp") Found reference to "CDSA/SHA384" (Indicator: "SHA384"; Source: "00000000-00005696.00000000.158764.00AD6000.00000004.mdmp, 00000000-00005696.00000001.160683.00AB3000.00000004.mdmp, 00000000-00005696.00000002.162605.00AB3000.00000004.mdmp")3e:T9c4,Found string - \\.\Scsi%d:; Source: "setup360_100100507_4001959_csMNFx8p.exe") Found string - \\.\PhysicalDrive%d; Source: "setup360_100100507_4001959_csMNFx8p.exe") Found string - \\.\360SelfProtection; Source: "setup360_100100507_4001959_csMNFx8p.exe") Found string - \\.\Scsi%d:; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found string - \\.\PhysicalDrive%d; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found string - \\.\360SelfProtection; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string - \\.\PhysicalDrive%d; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string - \\.\Scsi%d:; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string - \.\FILEVXD; Source: "00000000-00005696.00000000.158764.00AD6000.00000004.mdmp, 00000000-00005696.00000002.162605.00AB3000.00000004.mdmp") Found string - \.\REGVXD; Source: "00000000-00005696.00000000.158764.00AD6000.00000004.mdmp, 00000000-00005696.00000001.160683.00AB3000.00000004.mdmp") Found string - \\.\BW2K; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string - \\.\SUPERBPM; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string - \\.\ICEDUMP; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string - \\.\REGVXD; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string - \\.\NTICE; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string - \\.\SIWVID; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string - \\.\SICE; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string - \\.\FILEVXD; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string - \\.\FILEMON701; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string - \\.\REGMON701; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string - \\.\fengyue0; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string - \.\BW2K; Source: "00000000-00005696.00000001.160683.00AB3000.00000004.mdmp") Found string - \.\SIWVID; Source: "00000000-00005696.00000001.160683.00AB3000.00000004.mdmp")3f:T742,"setup360__100100507_4001959_csMNFx8p.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PHYSICALSTORES") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0119E81BE9A14CD8E22F40AC118C687ECBA3F4D8") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0119E81BE9A14CD8E22F40AC118C687ECBA3F4D8") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\06F1AA330B927B753A40E68CDF22E34BCBEF3352") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\06F1AA330B927B753A40E68CDF22E34BCBEF3352")40:Tcb0,"setup360__100100507_4001959_csMNFx8p.exe" queried SystemProcessInformation at 00000000-00005696-00000C15-1465930405 [PID: 5696] "setup360__100100507_4001959_csMNFx8p.exe" queried SystemProcessInformation at 00000000-00005696-00000C15-1465936883 [PID: 5696] "setup360__100100507_4001959_csMNFx8p.exe" queried SystemProcessInformation at 00000000-00005696-00000C15-1466150761 [PID: 5696] "setup360__100100507_4001959_csMNFx8p.exe" queried SystemProcessInformation at 00000000-00005696-00000C15-1466550946 [PID: 5696] "setup360__100100507_4001959_csMNFx8p.exe" queried SystemProcessInformation at 00000000-00005696-00000C15-1466557181 [PID: 5696] "setup360__100100507_4001959_csMNFx8p.exe" queried SystemProcessInformation at 00000000-00005696-00000C15-1470300513 [PID: 5696] "setup360__100100507_4001959_csMNFx8p.exe" queried SystemProcessInformation at 00000000-00005696-00000C15-1470309144 [PID: 5696] "setup360__100100507_4001959_csMNFx8p.exe" queried SystemProcessInformation at 00000000-00005696-00000C15-1472542970 [PID: 5696] "setup360__100100507_4001959_csMNFx8p.exe" queried SystemProcessInformation at 00000000-00005696-00000C15-1472549608 [PID: 5696] "setup360__100100507_4001959_csMNFx8p.exe" queried SystemProcessInformation at 00000000-00005696-00000C15-1473705590 [PID: 5696] "setup360__100100507_4001959_csMNFx8p.exe" queried SystemProcessInformation at 00000000-00005696-00000C15-1473711717 [PID: 5696] "setup360__100100507_4001959_csMNFx8p.exe" queried SystemProcessInformation at 00000000-00005696-00000C15-1473759210 [PID: 5696] "setup360__100100507_4001959_csMNFx8p.exe" queried SystemProcessInformation at 00000000-00005696-00000C15-1473765240 [PID: 5696] "setup360__100100507_4001959_csMNFx8p.exe" queried SystemProcessInformation at 00000000-00005696-00000C15-1473811599 [PID: 5696] "setup360__100100507_4001959_csMNFx8p.exe" queried SystemProcessInformation at 00000000-00005696-00000C15-1473818741 [PID: 5696] "setup360__100100507_4001959_csMNFx8p.exe" queried SystemProcessInformation at 00000000-00005696-00000C15-1473984244 [PID: 5696] "setup360__100100507_4001959_csMNFx8p.exe" queried SystemProcessInformation at 00000000-00005696-00000C15-1473990529 [PID: 5696] "setup360__100100507_4001959_csMNFx8p.exe" queried SystemProcessInformation at 00000000-00005696-00000C15-1474056539 [PID: 5696] "setup360__100100507_4001959_csMNFx8p.exe" queried SystemProcessInformation at 00000000-00005696-00000C15-1474062713 [PID: 5696] "setup360__100100507_4001959_csMNFx8p.exe" queried SystemProcessInformation at 00000000-00005696-00000C15-1474114045 [PID: 5696] "setup360__100100507_4001959_csMNFx8p.exe" queried SystemProcessInformation at 00000000-00005696-00000C15-1474120476 [PID: 5696] "setup360__100100507_4001959_csMNFx8p.exe" queried SystemProcessInformation at 00000000-00005696-00000C15-1474195672 [PID: 5696] "setup360__100100507_4001959_csMNFx8p.exe" queried SystemProcessInformation at 00000000-00005696-00000C15-1474215822 [PID: 5696] "setup360__100100507_4001959_csMNFx8p.exe" queried SystemProcessInformation at 00000000-00005696-00000C15-1474301215 [PID: 5696] "setup360__100100507_4001959_csMNFx8p.exe" queried SystemProcessInformation at 00000000-00005696-00000C15-1474311608 [PID: 5696]41:Te44,Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found api reference "CryptAcquireContextA" (Indicator: "CryptAcquireContextA"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found api reference "CryptHashData" (Indicator: "CryptHashData"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found api reference "CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found api reference "CryptStringToBinaryA" (Indicator: "CryptStringToBinaryA"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found api reference "CryptBinaryToStringA" (Indicator: "CryptBinaryToStringA"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found api reference "CryptQueryObject" (Indicator: "CryptQueryObject"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found api reference "CertFreeCertificateChainEngine" (Indicator: "CertFreeCertificateChain"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found api reference "CertFreeCertificateChainEngine" (Indicator: "CertFreeCertificateChainEngine"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found api reference "CertCreateCertificateChainEngine" (Indicator: "CertCreateCertificateChainEngine"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found api reference "CertGetNameStringA" (Indicator: "CertGetNameStringA"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found api reference "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found api reference "CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found api reference "schannel: CertGetCertificateChain error mask: 0x%08x" (Indicator: "CertGetCertificateChain"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found api reference "schannel: CertGetCertificateChain trust error CERT_TRUST_REVOCATION_STATUS_UNKNOWN" (Indicator: "CertGetCertificateChain"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found api reference "schannel: CertGetCertificateChain trust error CERT_TRUST_IS_NOT_TIME_VALID" (Indicator: "CertGetCertificateChain"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found api reference "schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT" (Indicator: "CertGetCertificateChain"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found api reference "schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN" (Indicator: "CertGetCertificateChain"; File: "setup360_100100507_4001959_csMNFx8p.exe")42:T19e3,"setup360__100100507_4001959_csMNFx8p.exe" called "CryptStringToBinaryA" with parameters {"pszString": "N4KbRKr/SNoUR1wZG7Lt79gLPiICq7g4Nxchkd9WZ7NNIL2Q1fjEDfNQ7JxbKyihUszb9Myimf2QgF+4Du6sY81u4MNOY4rBjutcd37B7GFChv8uobEl0zIfkmEUXlJBXqfjRnWk2lSvnyZTereev4Jt1qQy6CWw2nidcZHohT4=" "cchString": "0" "dwFlags": "1" "pcbBinary": "80000000"} "setup360__100100507_4001959_csMNFx8p.exe" called "CryptStringToBinaryA" with parameters {"pszString": "N4KbRKr/SNoUR1wZG7Lt79gLPiICq7g4Nxchkd9WZ7NNIL2Q1fjEDfNQ7JxbKyihUszb9Myimf2QgF+4Du6sY81u4MNOY4rBjutcd37B7GFChv8uobEl0zIfkmEUXlJBXqfjRnWk2lSvnyZTereev4Jt1qQy6CWw2nidcZHohT4=" "cchString": "0" "dwFlags": "1" "pbBinary": "37829b44aaff48da14475c191bb2edefd80b3e2202abb83837172191df5667b34d20bd90d5f8c40df350ec9c5b2b28a152ccdbf4cca299fd90805fb80eeeac63cd6ee0c34e638ac18eeb5c777ec1ec614286ff2ea1b125d3321f9261145e52415ea7e34675a4da54af9f26537ab79ebf826dd6a432e825b0da789d7191e8853e" "pcbBinary": "80000000"} "setup360__100100507_4001959_csMNFx8p.exe" called "CryptStringToBinaryA" with parameters {"pszString": "6tE0vrW74737gtwNwc2bBA==" "cchString": "0" "dwFlags": "1" "pcbBinary": "10000000"} "setup360__100100507_4001959_csMNFx8p.exe" called "CryptStringToBinaryA" with parameters {"pszString": "6tE0vrW74737gtwNwc2bBA==" "cchString": "0" "dwFlags": "1" "pbBinary": "ead134beb5bbe3bdfb82dc0dc1cd9b04" "pcbBinary": "10000000"} "setup360__100100507_4001959_csMNFx8p.exe" called "CryptStringToBinaryA" with parameters {"pszString": "Cmf7SNXwS+qcbhgcM7YSYw==" "cchString": "0" "dwFlags": "1" "pcbBinary": "10000000"} "setup360__100100507_4001959_csMNFx8p.exe" called "CryptStringToBinaryA" with parameters {"pszString": "Cmf7SNXwS+qcbhgcM7YSYw==" "cchString": "0" "dwFlags": "1" "pbBinary": "g" "pcbBinary": "10000000"} "setup360__100100507_4001959_csMNFx8p.exe" called "CryptStringToBinaryA" with parameters {"cchString": "0" "dwFlags": "1" "pcbBinary": "906a0000"} "setup360__100100507_4001959_csMNFx8p.exe" called "CryptStringToBinaryA" with parameters {"cchString": "0" "dwFlags": "1" "pbBinary": "b6f20924032e2c48e63f6a006de864fa65e660a3e8a2b5b43b152f60f94a1bc5c118ff2a8c83356666e542fae1311f8c068d43c354a50c0eff3495ea1730c0895ad6480a98c8504a50fe3fdd463237256fc8b6be792d591fe9a041e15201d5f8ee7b5d478743d52897a3ee7692c9a663995b30a66b2f2619b42f42d00433cd71a9cea46e1e58faa0bf39af974b96d048ddfad291c990a6760b7df76d3d81db915381c80a92e214bc80e25ff144b26e24b134d5e5eea1ce6b220b72f4a27dff88781c45baf260d91b5ecd12f6d5278cdec27998a959e0f775572393f0c25029d2c8e4343fa9c55bb2a80aa4955268844a50c46f81053bc51a0d8636d01112f8c43706fd0afae764427b0da4dac778d9ea4a475f2fc324cd9858955893f11de7bd6c6343c98178ad69dfed5fa8e46e5f7a76295d35a4d3af25ba4b50b1adf89c5d13f858375e94138ecabf7f4b4031c3f36e92c23998fbe23c71ecd3968c19dd83d25d4350a0950a2903816bcec783b5c24756f8f042215f589f1cbe4e825cdb819e296f9120784b67054056f74419d8cfdbdff6ec3258a932d50534f428f5860c912cc8236a5a1e7bf7e2be1b1cdb8f59f5d628a00552e9cb64e48bc59fa2fab1b29aaa019bda19130fe1a0b08771b5ae2440b97d571ae5fbab2ecd599dd4e40c7b721c601932e7bc2318aaaa442c154860f6bfb555a47729fc0805cdfa423dc6b1cbca1184585e5bf8b23c1cac7d68b6885a877582188f9f9e0dfea70830b77484b3425ed49ba3270c12b083d5688cf0eef83958e2d27f9b0e1c2582474a4aa3b2f5ce1737927b570c64fe58bc3cc77c62dec1eccd0f5ba7fe1128fd064351e243488f31cd925c34d1898efdb6705ec1a09b05268d5efdf97df25dabd2c4bff6bff560694fc0abfef090c36a39fdce44e34119f3cb869d8005868c906bf474b493a604ac3b1936076f05aed4d867e94112664481217a9e189b00015d52dedf5d4e7975684dcd690600f7a416a62538a25b852f0844211d77a7f2c46d7de31bfab3cf60a450c5f6ad0471079c78ac0c9352fedd0beadaf938d5cb634aea4a44ff8edaa7803e66e69d7102cfaa38ca1587163c3e23e87fe286afc0865f9d939c098b6ae6d79c3167198344d8b582edbd544d29db89db7c109ec3de61423f9e7b24df6b9ec8ad814d24bb8cadb4ae17e188b6aab3148342f026af40fd6b7d87826df7f9fb405aa86a0638e40464606d0bf787ac83d71cfd34e1068707dedab6e56028d717b8a2600503789fcf4589a4e956de0b1f8fd019a8d2effb7a31ea2b9e2b3fbf23bc7666a9bdd1713991adfd14dbbc48edbafcbbb930a558991cf110b186b3adf08a7f0a91c49dc24898d7eec265ae7b3d70ed7e73d06761f6f0ddec6e7ebb6029c7e13439293fb0d3c5f39a39392b40e3c6773bfd37ae7d73b896397e63" "pcbBinary": "906a0000"} "setup360__100100507_4001959_csMNFx8p.exe" called "CryptStringToBinaryA" with parameters {"pszString": "FPy6B2HMr/mBOw2Ydb0ydVSvv+cQePfc+XpBnDGUKTJHc9o5NwCRbfZ4s6pT0oMygPzDCCDH6wXkVjOPqqPcFfcVzBBDAFD1067cTN4+Qtn3g66Rb2iD31OfGXpqQzYfzA4MNNClw62QHfAaimndfZJxYkiDhYBLjSjW/ct9/II=" "cchString": "0" "dwFlags": "1" "pcbBinary": "80000000"} "setup360__100100507_4001959_csMNFx8p.exe" called "CryptStringToBinaryA" with parameters {"pszString": "FPy6B2HMr/mBOw2Ydb0ydVSvv+cQePfc+XpBnDGUKTJHc9o5NwCRbfZ4s6pT0oMygPzDCCDH6wXkVjOPqqPcFfcVzBBDAFD1067cTN4+Qtn3g66Rb2iD31OfGXpqQzYfzA4MNNClw62QHfAaimndfZJxYkiDhYBLjSjW/ct9/II=" "cchString": "0" "dwFlags": "1" "pbBinary": "14fcba0761ccaff9813b0d9875bd327554afbfe71078f7dcf97a419c319429324773da393700916df678b3aa53d2833280fcc30820c7eb05e456338faaa3dc15f715cc10430050f5d3aedc4cde3e42d9f783ae916f6883df539f197a6a43361fcc0e0c34d0a5c3ad901df01a8a69dd7d927162488385804b8d28d6fdcb7dfc82" "pcbBinary": "80000000"} "zoolsfCkUdFaJ19.exe" called "CryptStringToBinaryA" with parameters {"pszString": "IAAtAE0AdQB0AGUAeAA9AHsANgBEADkAOABCADAAQQBBAC0ANgBEADcANQAtADQAOAA2AGIALQA4AEUAOABGAC0AMQAyAEMAQgBBADcARQAyADMAMgA3AEYAfQAgAC0AQwBhAGwAbABJAGQAPQA0ADAAMAAxADkANQA5ACAALQBQAHIAbwBkAHUAYwB0AD0AMAAgAC0ARABsAGwAVgBlAHIAPQAyADAAMAAxADMAMQA4AAAA" "cchString": "248" "dwFlags": "1" "pcbBinary": "b4000000"} "zoolsfCkUdFaJ19.exe" called "CryptStringToBinaryW" with parameters {"pszString": "IAAtAE0AdQB0AGUAeAA9AHsANgBEADkAOABCADAAQQBBAC0ANgBEADcANQAtADQAOAA2AGIALQA4AEUAOABGAC0AMQAyAEMAQgBBADcARQAyADMAMgA3AEYAfQAgAC0A" "cchString": "248" "dwFlags": "1" "pcbBinary": "b4000000"} "zoolsfCkUdFaJ19.exe" called "CryptStringToBinaryA" with parameters {"pszString": "IAAtAE0AdQB0AGUAeAA9AHsANgBEADkAOABCADAAQQBBAC0ANgBEADcANQAtADQAOAA2AGIALQA4AEUAOABGAC0AMQAyAEMAQgBBADcARQAyADMAMgA3AEYAfQAgAC0AQwBhAGwAbABJAGQAPQA0ADAAMAAxADkANQA5ACAALQBQAHIAbwBkAHUAYwB0AD0AMAAgAC0ARABsAGwAVgBlAHIAPQAyADAAMAAxADMAMQA4AAAA" "cchString": "248" "dwFlags": "1" "pbBinary": "-Mutex={6D98B0AA-6D75-486b-8E8F-12CBA7E2327F} -CallId=4001959 -Product=0 -DllVer=2001318" "pcbBinary": "b4000000"} "zoolsfCkUdFaJ19.exe" called "CryptStringToBinaryW" with parameters {"pszString": "IAAtAE0AdQB0AGUAeAA9AHsANgBEADkAOABCADAAQQBBAC0ANgBEADcANQAtADQAOAA2AGIALQA4AEUAOABGAC0AMQAyAEMAQgBBADcARQAyADMAMgA3AEYAfQAgAC0A" "cchString": "248" "dwFlags": "1" "pbBinary": "-Mutex={6D98B0AA-6D75-486b-8E8F-12CBA7E2327F} -CallId=4001959 -Product=0 -DllVer=2001318" "pcbBinary": "b4000000"}43:Tee3,Assembly shows XOR instruction xor eax ebp in Stream UID: 14307-228-0046C471 Assembly shows XOR instruction xor ecx ebp in Stream UID: 14307-228-0046C471 Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 14307-1704-00405750 Assembly shows XOR instruction xor eax ebp in Stream UID: 14307-1704-00405750 Assembly shows XOR instruction xor eax ebp in Stream UID: 14307-1711-0040DB30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 14307-1711-0040DB30 Assembly shows XOR instruction xor eax esp in Stream UID: 14307-1713-0040DF80 Assembly shows XOR instruction xor eax esp in Stream UID: 14307-1715-0040D8E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 14307-1738-00461D21 Assembly shows XOR instruction xor eax esp in Stream UID: 14307-1932-004A98B0 Assembly shows XOR instruction xor ecx esp in Stream UID: 14307-1932-004A98B0 Assembly shows XOR instruction xor eax esp in Stream UID: 14307-2094-0049D2D0 Assembly shows XOR instruction xor ecx esp in Stream UID: 14307-2094-0049D2D0 Assembly shows XOR instruction xor eax esp in Stream UID: 14307-2195-004979C0 Assembly shows XOR instruction xor ecx esp in Stream UID: 14307-2195-004979C0 Assembly shows XOR instruction xor byte ptr [ebx+00h] 00h in Stream UID: 14307-2215-004AFFEE Assembly shows XOR instruction xor eax ebp in Stream UID: 14307-2267-0046AEB0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 14307-2267-0046AEB0 Assembly shows XOR instruction xor eax esp in Stream UID: 14307-2273-004982F0 Assembly shows XOR instruction xor ecx esp in Stream UID: 14307-2273-004982F0 Assembly shows XOR instruction xor cl byte ptr [ebp-02h] in Stream UID: 14307-2303-004B3DEB Assembly shows XOR instruction xor byte ptr [eax] cl in Stream UID: 14307-2303-004B3DEB Assembly shows XOR instruction xor eax esp in Stream UID: 14307-2444-0049E550 Assembly shows XOR instruction xor ecx esp in Stream UID: 14307-2444-0049E550 Assembly shows XOR instruction xor eax ebp in Stream UID: 14307-2451-00480B98 Assembly shows XOR instruction xor ecx ebp in Stream UID: 14307-2451-00480B98 Assembly shows XOR instruction xor eax esp in Stream UID: 14307-2522-0049A870 Assembly shows XOR instruction xor ecx esp in Stream UID: 14307-2522-0049A870 Assembly shows XOR instruction xor eax esp in Stream UID: 14307-2551-004960F0 Assembly shows XOR instruction xor ecx esp in Stream UID: 14307-2551-004960F0 Assembly shows XOR instruction xor eax esp in Stream UID: 14307-2555-004966C0 Assembly shows XOR instruction xor ecx esp in Stream UID: 14307-2555-004966C0 Assembly shows XOR instruction xor eax esp in Stream UID: 14307-2556-00495B90 Assembly shows XOR instruction xor ecx esp in Stream UID: 14307-2556-00495B90 Assembly shows XOR instruction xor eax esp in Stream UID: 14307-2560-00496510 Assembly shows XOR instruction xor ecx esp in Stream UID: 14307-2560-00496510 Assembly shows XOR instruction xor eax esp in Stream UID: 14307-2588-004814A0 Assembly shows XOR instruction xor ecx esp in Stream UID: 14307-2588-004814A0 Assembly shows XOR instruction xor eax esp in Stream UID: 14307-2593-00496C30 Assembly shows XOR instruction xor ecx esp in Stream UID: 14307-2593-00496C30 Assembly shows XOR instruction xor ebx 01h in Stream UID: 14307-2593-00496C30 Assembly shows XOR instruction xor eax ebp in Stream UID: 14307-2626-004B1EC0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 14307-2626-004B1EC0 Assembly shows XOR instruction xor eax ebp in Stream UID: 14307-2627-004B4949 Assembly shows XOR instruction xor ecx ebp in Stream UID: 14307-2627-004B4949 Assembly shows XOR instruction xor eax esp in Stream UID: 14307-2818-00486070 Assembly shows XOR instruction xor ecx esp in Stream UID: 14307-2818-0048607044:T97f,Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "CryptAcquireContextA" (Indicator: "CryptAcquireContext"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "CryptHashData" (Indicator: "CryptHashData"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "CertCloseStore" (Indicator: "CertCloseStore"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "CertGetNameStringA" (Indicator: "CertGetNameString"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names" (Indicator: "CertGetNameString"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "schannel: CertGetNameString() returned certificate name information of unexpected size" (Indicator: "CertGetNameString"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "schannel: CertGetNameString() returned no certificate name information" (Indicator: "CertGetNameString"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "CertCompareCertificate" (Indicator: "CertCompareCertificate"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "CertDeleteCertificateFromStore" (Indicator: "CertDeleteCertificateFromStore"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "CertGetNameStringW" (Indicator: "CertGetNameString"; File: "setup360_100100507_4001959_csMNFx8p.exe")45:T46c,Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "CryptAcquireContextA" (Indicator: "CryptAcquireContextA"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "CryptGenRandom" (Indicator: "CryptGenRandom"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "CryptHashData" (Indicator: "CryptHashData"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "CryptBinaryToStringA" (Indicator: "CryptBinaryToString"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "CryptBinaryToStringW" (Indicator: "CryptBinaryToString"; File: "setup360_100100507_4001959_csMNFx8p.exe")46:Td9a,Found string "-----END PUBLIC KEY-----" (Indicator: "public key"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found string "-----BEGIN PUBLIC KEY-----" (Indicator: "public key"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found string "public key hash: sha256//%s" (Indicator: "public key"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found string "SSL: failed retrieving public key from server certificate" (Indicator: "public key"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found string "SSL: public key does not match pinned public key!" (Indicator: "public key"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found string "SSL public key does not match pinned public key" (Indicator: "public key"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found string "RSA Public Key" (Indicator: "public key"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found string "RSA Public Key (%lu bits)" (Indicator: "public key"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found string "Public Key Algorithm: %s" (Indicator: "public key"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found string "Public Key Algorithm" (Indicator: "public key"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found string "-----END PUBLIC KEY-----" (Indicator: "public key"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string "-----BEGIN PUBLIC KEY-----" (Indicator: "public key"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string "public key hash: sha256//%s" (Indicator: "public key"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string "SSL: failed retrieving public key from server certificate" (Indicator: "public key"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string "SSL: public key does not match pinned public key!" (Indicator: "public key"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string "SSL public key does not match pinned public key" (Indicator: "public key"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string "RSA Public Key" (Indicator: "public key"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string "RSA Public Key (%lu bits)" (Indicator: "public key"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string "Public Key Algorithm: %s" (Indicator: "public key"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string "Public Key Algorithm" (Indicator: "public key"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string "ncrypted Private Key" (Indicator: "private key"; Source: "00000000-00005696.00000000.158764.00AD6000.00000004.mdmp, 00000000-00005696.00000001.160683.00AB3000.00000004.mdmp, 00000000-00005696.00000002.162605.00AB3000.00000004.mdmp")47:Tae4a,Contains base64 string in header "aadc6efcafa1272b7bb902eeecd9eb62" in header "GET /safe/instcomp.htm?type=onebox_setup&act=3&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive" Contains base64 string in header "23f0ef3958accbbb543a1067d28c805f479293382b7e" in header "GET /safe/instcomp.htm?type=onebox_setup&act=3&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive" Contains base64 string in header "Encoding" in header "GET /safe/instcomp.htm?type=onebox_setup&act=3&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive" Contains base64 string in header "gzip" in header "GET /safe/instcomp.htm?type=onebox_setup&act=3&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive" Contains base64 string in header "MSIE" in header "GET /safe/instcomp.htm?type=onebox_setup&act=3&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive" Contains base64 string in header "NET4" in header "GET /safe/instcomp.htm?type=onebox_setup&act=3&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive" Contains base64 string in header "InfoPath" in header "GET /safe/instcomp.htm?type=onebox_setup&act=3&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive" Contains base64 string in header "Host" in header "GET /safe/instcomp.htm?type=onebox_setup&act=3&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive" Contains base64 string in header "cnConnection" in header "GET /safe/instcomp.htm?type=onebox_setup&act=3&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /safe/instcomp.htm?type=onebox_setup&act=3&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive" Contains base64 string in header "sfdl" in header "GET /gf/360ini.cab HTTP/1.1User-Agent: BeaconHost: sfdl.360safe.comCache-Control: no-cache" Contains base64 string in header "comCache" in header "GET /gf/360ini.cab HTTP/1.1User-Agent: BeaconHost: sfdl.360safe.comCache-Control: no-cache" Contains base64 string in header "23f0ef3958accbbb543a1067d28c805f479293382b7e" in header "GET /client/dc?m2=23f0ef3958accbbb543a1067d28c805f479293382b7e×trap=1791705540&version=1.0.0.1151&sign=7559a1b67eb038c285d2f55c50f6a005 HTTP/1.1Host: bapi.safe.360.cnAccept: */*Pragma: no-cacheCache-Control: no-cache" Contains base64 string in header "1151" in header "GET /client/dc?m2=23f0ef3958accbbb543a1067d28c805f479293382b7e×trap=1791705540&version=1.0.0.1151&sign=7559a1b67eb038c285d2f55c50f6a005 HTTP/1.1Host: bapi.safe.360.cnAccept: */*Pragma: no-cacheCache-Control: no-cache" Contains base64 string in header "7559a1b67eb038c285d2f55c50f6a005" in header "GET /client/dc?m2=23f0ef3958accbbb543a1067d28c805f479293382b7e×trap=1791705540&version=1.0.0.1151&sign=7559a1b67eb038c285d2f55c50f6a005 HTTP/1.1Host: bapi.safe.360.cnAccept: */*Pragma: no-cacheCache-Control: no-cache" Contains base64 string in header "bapi" in header "GET /client/dc?m2=23f0ef3958accbbb543a1067d28c805f479293382b7e×trap=1791705540&version=1.0.0.1151&sign=7559a1b67eb038c285d2f55c50f6a005 HTTP/1.1Host: bapi.safe.360.cnAccept: */*Pragma: no-cacheCache-Control: no-cache" Contains base64 string in header "safe" in header "GET /client/dc?m2=23f0ef3958accbbb543a1067d28c805f479293382b7e×trap=1791705540&version=1.0.0.1151&sign=7559a1b67eb038c285d2f55c50f6a005 HTTP/1.1Host: bapi.safe.360.cnAccept: */*Pragma: no-cacheCache-Control: no-cache" Contains base64 string in header "cnAccept" in header "GET /client/dc?m2=23f0ef3958accbbb543a1067d28c805f479293382b7e×trap=1791705540&version=1.0.0.1151&sign=7559a1b67eb038c285d2f55c50f6a005 HTTP/1.1Host: bapi.safe.360.cnAccept: */*Pragma: no-cacheCache-Control: no-cache" Contains base64 string in header "User" in header "GET /soft/getinfo?info=[[100100507,"",0]] HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; InstSoft)Host: cx.soft.360.cnCache-Control: no-cache" Contains base64 string in header "MSIE" in header "GET /soft/getinfo?info=[[100100507,"",0]] HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; InstSoft)Host: cx.soft.360.cnCache-Control: no-cache" Contains base64 string in header "InstSoft" in header "GET /soft/getinfo?info=[[100100507,"",0]] HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; InstSoft)Host: cx.soft.360.cnCache-Control: no-cache" Contains base64 string in header "Host" in header "GET /soft/getinfo?info=[[100100507,"",0]] HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; InstSoft)Host: cx.soft.360.cnCache-Control: no-cache" Contains base64 string in header "soft" in header "GET /soft/getinfo?info=[[100100507,"",0]] HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; InstSoft)Host: cx.soft.360.cnCache-Control: no-cache" Contains base64 string in header "User" in header "GET /dm/72_72_100/t01709f600470d50b78.png HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; InstSoft)Host: p0.qhimg.comCache-Control: no-cache" Contains base64 string in header "MSIE" in header "GET /dm/72_72_100/t01709f600470d50b78.png HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; InstSoft)Host: p0.qhimg.comCache-Control: no-cache" Contains base64 string in header "InstSoft" in header "GET /dm/72_72_100/t01709f600470d50b78.png HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; InstSoft)Host: p0.qhimg.comCache-Control: no-cache" Contains base64 string in header "Host" in header "GET /dm/72_72_100/t01709f600470d50b78.png HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; InstSoft)Host: p0.qhimg.comCache-Control: no-cache" Contains base64 string in header "comCache" in header "GET /dm/72_72_100/t01709f600470d50b78.png HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; InstSoft)Host: p0.qhimg.comCache-Control: no-cache" Contains base64 string in header "aadc6efcafa1272b7bb902eeecd9eb62" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=700&r=0&d=99990001 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=700&r=0&d=99990001 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "99990001" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=700&r=0&d=99990001 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "Language" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=700&r=0&d=99990001 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "like" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=700&r=0&d=99990001 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "aadc6efcafa1272b7bb902eeecd9eb62" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=705&r=0&d=99990001 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=705&r=0&d=99990001 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "99990001" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=705&r=0&d=99990001 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "Language" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=705&r=0&d=99990001 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "like" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=705&r=0&d=99990001 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "aadc6efcafa1272b7bb902eeecd9eb62" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=3000&r=0&d=0 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=3000&r=0&d=0 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "3000" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=3000&r=0&d=0 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "Language" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=3000&r=0&d=0 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "like" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=3000&r=0&d=0 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "aadc6efcafa1272b7bb902eeecd9eb62" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=3001&r=0&d=0 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=3001&r=0&d=0 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "3001" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=3001&r=0&d=0 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "Language" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=3001&r=0&d=0 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "like" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=3001&r=0&d=0 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "aadc6efcafa1272b7bb902eeecd9eb62" in header "GET /safe/instcomp.htm?type=onebox_setup&act=6&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive" Contains base64 string in header "23f0ef3958accbbb543a1067d28c805f479293382b7e" in header "GET /safe/instcomp.htm?type=onebox_setup&act=6&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive" Contains base64 string in header "Encoding" in header "GET /safe/instcomp.htm?type=onebox_setup&act=6&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive" Contains base64 string in header "gzip" in header "GET /safe/instcomp.htm?type=onebox_setup&act=6&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive" Contains base64 string in header "MSIE" in header "GET /safe/instcomp.htm?type=onebox_setup&act=6&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive" Contains base64 string in header "NET4" in header "GET /safe/instcomp.htm?type=onebox_setup&act=6&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive" Contains base64 string in header "InfoPath" in header "GET /safe/instcomp.htm?type=onebox_setup&act=6&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive" Contains base64 string in header "Host" in header "GET /safe/instcomp.htm?type=onebox_setup&act=6&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive" Contains base64 string in header "cnConnection" in header "GET /safe/instcomp.htm?type=onebox_setup&act=6&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /safe/instcomp.htm?type=onebox_setup&act=6&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive" Contains base64 string in header "23f0ef3958accbbb543a1067d28c805f479293382b7e" in header "GET /main/v1/ws/dlink?channel=4001959&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e&mid=aadc6efcafa1272b7bb902eeecd9eb62×tramp=1791706384&version=1.0.0.1151&sign=0b3721c7e4e0a593a9f33b408dcf38d0 HTTP/1.1Host: promotion.aiwork.360.cnAccept: */*Pragma: no-cacheCache-Control: no-cache" Contains base64 string in header "aadc6efcafa1272b7bb902eeecd9eb62" in header "GET /main/v1/ws/dlink?channel=4001959&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e&mid=aadc6efcafa1272b7bb902eeecd9eb62×tramp=1791706384&version=1.0.0.1151&sign=0b3721c7e4e0a593a9f33b408dcf38d0 HTTP/1.1Host: promotion.aiwork.360.cnAccept: */*Pragma: no-cacheCache-Control: no-cache" Contains base64 string in header "1151" in header "GET /main/v1/ws/dlink?channel=4001959&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e&mid=aadc6efcafa1272b7bb902eeecd9eb62×tramp=1791706384&version=1.0.0.1151&sign=0b3721c7e4e0a593a9f33b408dcf38d0 HTTP/1.1Host: promotion.aiwork.360.cnAccept: */*Pragma: no-cacheCache-Control: no-cache" Contains base64 string in header "0b3721c7e4e0a593a9f33b408dcf38d0" in header "GET /main/v1/ws/dlink?channel=4001959&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e&mid=aadc6efcafa1272b7bb902eeecd9eb62×tramp=1791706384&version=1.0.0.1151&sign=0b3721c7e4e0a593a9f33b408dcf38d0 HTTP/1.1Host: promotion.aiwork.360.cnAccept: */*Pragma: no-cacheCache-Control: no-cache" Contains base64 string in header "cnAccept" in header "GET /main/v1/ws/dlink?channel=4001959&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e&mid=aadc6efcafa1272b7bb902eeecd9eb62×tramp=1791706384&version=1.0.0.1151&sign=0b3721c7e4e0a593a9f33b408dcf38d0 HTTP/1.1Host: promotion.aiwork.360.cnAccept: */*Pragma: no-cacheCache-Control: no-cache" Contains base64 string in header "aadc6efcafa1272b7bb902eeecd9eb62" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=1200&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=1200&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "1200" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=1200&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "Language" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=1200&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "like" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=1200&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "aadc6efcafa1272b7bb902eeecd9eb62" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=201&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=201&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "Language" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=201&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "like" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=201&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "aadc6efcafa1272b7bb902eeecd9eb62" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=234&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=234&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "Language" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=234&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "like" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=234&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "aadc6efcafa1272b7bb902eeecd9eb62" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=668&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=668&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "Language" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=668&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "like" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=668&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "aadc6efcafa1272b7bb902eeecd9eb62" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=722&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=722&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "Language" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=722&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "like" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=722&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "aadc6efcafa1272b7bb902eeecd9eb62" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=723&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=723&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "Language" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=723&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "like" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=723&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "aadc6efcafa1272b7bb902eeecd9eb62" in header "GET /main/v1/silent-install/allow?ipartner=4001959&product=ws&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&only_check_reasons= HTTP/1.1Host: kittip-api.safe.360.cnAccept: */*Pragma: no-cacheCache-Control: no-cache" Contains base64 string in header "2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60" in header "GET /main/v1/silent-install/allow?ipartner=4001959&product=ws&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&only_check_reasons= HTTP/1.1Host: kittip-api.safe.360.cnAccept: */*Pragma: no-cacheCache-Control: no-cache" Contains base64 string in header "only" in header "GET /main/v1/silent-install/allow?ipartner=4001959&product=ws&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&only_check_reasons= HTTP/1.1Host: kittip-api.safe.360.cnAccept: */*Pragma: no-cacheCache-Control: no-cache" Contains base64 string in header "reasons=" in header "GET /main/v1/silent-install/allow?ipartner=4001959&product=ws&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&only_check_reasons= HTTP/1.1Host: kittip-api.safe.360.cnAccept: */*Pragma: no-cacheCache-Control: no-cache" Contains base64 string in header "safe" in header "GET /main/v1/silent-install/allow?ipartner=4001959&product=ws&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&only_check_reasons= HTTP/1.1Host: kittip-api.safe.360.cnAccept: */*Pragma: no-cacheCache-Control: no-cache" Contains base64 string in header "cnAccept" in header "GET /main/v1/silent-install/allow?ipartner=4001959&product=ws&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&only_check_reasons= HTTP/1.1Host: kittip-api.safe.360.cnAccept: */*Pragma: no-cacheCache-Control: no-cache" Contains base64 string in header "aadc6efcafa1272b7bb902eeecd9eb62" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=51&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=51&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "Language" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=51&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "like" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=51&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "aadc6efcafa1272b7bb902eeecd9eb62" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&v=2001318&w=0&b=48&d=4001959&o=70 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "Language" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&v=2001318&w=0&b=48&d=4001959&o=70 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "like" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&v=2001318&w=0&b=48&d=4001959&o=70 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "aadc6efcafa1272b7bb902eeecd9eb62" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=202&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=202&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "Language" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=202&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "like" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=202&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "aadc6efcafa1272b7bb902eeecd9eb62" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=210&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=210&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "Language" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=210&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "like" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=210&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "aadc6efcafa1272b7bb902eeecd9eb62" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=212&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=212&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "Language" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=212&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "like" in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=212&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "c9731341bc338dc071c21f32b62d1e82" in header "GET /hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=229&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "Language" in header "GET /hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=229&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "like" in header "GET /hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=229&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "c9731341bc338dc071c21f32b62d1e82" in header "GET /hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=228&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "Language" in header "GET /hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=228&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn" Contains base64 string in header "like" in header "GET /hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=228&r=0&d=4001959 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: zh-CNUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: s.360.cn"48:T64d,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains reference to cryptographic keys Matched sigs: Possibly contains Public/Private key (encryption) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Command line contains long Base64-encoded string Matched sigs: Contains reference to crypto DLLs Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: Uses Windows cryptography API for obfuscation Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Contains key cryptographic functions of the CryptoAPI Matched sigs: YARA signature match - AES encryption49:T3441,Found XOR loop in file "360ini.dll" at offset 75164; code bytes = 30d0 Found XOR loop in file "360ini.dll" at offset 294273; code bytes = 30d0 Found XOR loop in file "360ini.dll" at offset 978980; code bytes = 30d0 Found XOR loop in file "360ini.dll" at offset 1034268; code bytes = 30d0 Found XOR loop in file "360ini.dll" at offset 1522571; code bytes = 30d0 Found XOR loop in file "360ini.dll" at offset 1563411; code bytes = 30d0 Found XOR loop in file "360ini.dll" at offset 1571023; code bytes = 30d0 Found XOR loop in file "360ini.dll" at offset 1596254; code bytes = 30d0 Found XOR loop in file "360ini.dll" at offset 1621529; code bytes = 30d0 Found XOR loop in file "360ini.dll" at offset 1816681; code bytes = 30d0 Found XOR loop in file "360ini.dll" at offset 1856092; code bytes = 30d0 Found XOR loop in file "360ini.dll" at offset 1878968; code bytes = 30d0 Found XOR loop in file "360ini.dll" at offset 1880966; code bytes = 30d0 Found XOR loop in file "360ini.dll" at offset 3700710; code bytes = 30d0 Found XOR loop in file "360ini.dll" at offset 3946584; code bytes = 30d0 Found XOR loop in file "360ini.dll" at offset 4204454; code bytes = 30d0 Found XOR loop in file "360ini.dll" at offset 4470167; code bytes = 30d0 Found XOR loop in file "360ini.dll" at offset 4490857; code bytes = 30d0 Found XOR loop in file "360ini.dll" at offset 4492427; code bytes = 30d0 Found XOR loop in file "360ini.dll" at offset 4496173; code bytes = 30d0 Found XOR loop in file "360ini.dll" at offset 4501923; code bytes = 30d0 Found XOR loop in file "360ini.dll" at offset 4507501; code bytes = 30d0 Found XOR loop in file "360ini.dll" at offset 3114; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 3134; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 3152; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 3232; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 3252; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 3270; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 3352; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 3372; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 3390; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 3501; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 3659; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 4976; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 323781; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 323807; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 328285; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 328757; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 328963; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 328989; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 329219; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 329245; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 411455; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 411735; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 411757; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 411829; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 411925; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 412021; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 526413; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 526483; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 526577; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 526769; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 549497; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 550118; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 580462; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 584939; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 956193; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 1532781; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 1616396; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 1617354; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 1620454; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 1821353; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 1822620; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 2604783; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 2619483; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 2620411; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 2627035; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 2627497; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 2741341; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 2741412; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 2784787; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 2784834; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 2784882; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 2784930; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 2784977; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 2815637; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 2935265; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 2984819; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 2995401; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 3010172; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 3024543; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 3024594; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 3024644; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 3024703; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 3049755; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 3050374; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 3056818; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 3081408; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 3126857; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 3128638; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 3171101; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 3309426; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 3944224; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 4039156; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 4045870; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 4467339; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 4481055; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 4490385; code bytes = 33c1 Found XOR loop in file "360ini.dll" at offset 331947; code bytes = 8030 Found XOR loop in file "360ini.dll" at offset 339345; code bytes = 8030 Found XOR loop in file "360ini.dll" at offset 339374; code bytes = 8030 Found XOR loop in file "360ini.dll" at offset 346319; code bytes = 8030 Found XOR loop in file "360ini.dll" at offset 357835; code bytes = 8030 Found XOR loop in file "360ini.dll" at offset 358743; code bytes = 8030 Found XOR loop in file "360ini.dll" at offset 1511060; code bytes = 8030 Found XOR loop in file "360ini.dll" at offset 1534292; code bytes = 8030 Found XOR loop in file "360ini.dll" at offset 1615014; code bytes = 8030 Found XOR loop in file "360ini.dll" at offset 1643470; code bytes = 8030 Found XOR loop in file "360ini.dll" at offset 1757939; code bytes = 8030 Found XOR loop in file "360ini.dll" at offset 1873438; code bytes = 8030 Found XOR loop in file "360ini.dll" at offset 2087199; code bytes = 8030 Found XOR loop in file "360ini.dll" at offset 2352252; code bytes = 8030 Found XOR loop in file "360ini.dll" at offset 2442400; code bytes = 8030 Found XOR loop in file "360ini.dll" at offset 2609156; code bytes = 8030 Found XOR loop in file "360ini.dll" at offset 2616098; code bytes = 8030 Found XOR loop in file "360ini.dll" at offset 2784574; code bytes = 8030 Found XOR loop in file "360ini.dll" at offset 2838824; code bytes = 8030 Found XOR loop in file "360ini.dll" at offset 4275917; code bytes = 8030 Found XOR loop in file "360ini.dll" at offset 4473574; code bytes = 8030 Found XOR loop in file "360ini.dll" at offset 4477912; code bytes = 8030 Found XOR loop in file "360ini.dll" at offset 4495324; code bytes = 8030 Found XOR loop in file "360ini.dll" at offset 4496134; code bytes = 8030 Found XOR loop in file "360ini.dll" at offset 4501022; code bytes = 8030 Found XOR loop in file "360ini.dll" at offset 4503958; code bytes = 8030 Found XOR loop in file "360ini.dll" at offset 4506276; code bytes = 8030 Found XOR loop in file "360ini.dll" at offset 4534333; code bytes = 8030 Found XOR loop in file "360ini.dll" at offset 4537088; code bytes = 8030 Found XOR loop in file "zoolsfCkUdFaJ19.exe" at offset 6793; code bytes = 8030 Found XOR loop in file "tAgXmEoSeJkBaOaV64.tmp" at offset 34117; code bytes = 33c1 Found XOR loop in file "tAgXmEoSeJkBaOaV64.tmp" at offset 37756; code bytes = 33c1 Found XOR loop in file "tAgXmEoSeJkBaOaV64.tmp" at offset 37966; code bytes = 33c1 Found XOR loop in file "tAgXmEoSeJkBaOaV64.tmp" at offset 38017; code bytes = 33c1 Found XOR loop in file "tAgXmEoSeJkBaOaV64.tmp" at offset 38094; code bytes = 33c1 Found XOR loop in file "tAgXmEoSeJkBaOaV64.tmp" at offset 38117; code bytes = 33c1 Found XOR loop in file "tAgXmEoSeJkBaOaV64.tmp" at offset 38142; code bytes = 33c1 Found XOR loop in file "tAgXmEoSeJkBaOaV64.tmp" at offset 38251; code bytes = 33c1 Found XOR loop in file "tAgXmEoSeJkBaOaV64.tmp" at offset 38279; code bytes = 33c1 Found XOR loop in file "tAgXmEoSeJkBaOaV64.tmp" at offset 38391; code bytes = 33c1 Found XOR loop in file "tAgXmEoSeJkBaOaV64.tmp" at offset 38418; code bytes = 33c1 Found XOR loop in file "tAgXmEoSeJkBaOaV64.tmp" at offset 38501; code bytes = 33c1 Found XOR loop in file "tAgXmEoSeJkBaOaV64.tmp" at offset 56424; code bytes = 33c1 Found XOR loop in file "tAgXmEoSeJkBaOaV64.tmp" at offset 56503; code bytes = 33c1 Found XOR loop in file "tAgXmEoSeJkBaOaV64.tmp" at offset 56556; code bytes = 33c1 Found XOR loop in file "tAgXmEoSeJkBaOaV64.tmp" at offset 56638; code bytes = 33c1 Found XOR loop in file "tAgXmEoSeJkBaOaV64.tmp" at offset 56749; code bytes = 33c1 Found XOR loop in file "tAgXmEoSeJkBaOaV64.tmp" at offset 56778; code bytes = 33c1 Found XOR loop in file "tAgXmEoSeJkBaOaV64.tmp" at offset 67519; code bytes = 8030 Found XOR loop in file "tAgXmEoSeJkBaOaV64.tmp" at offset 196669; code bytes = 8030 Found XOR loop in file "tAgXmEoSeJkBaOaV64.tmp" at offset 199424; code bytes = 8030 Found XOR loop in file "tAgXmEoSeJkBaOaV64.tmp" at offset 199600; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 971387; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 983249; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 991339; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 992935; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 281498; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 281577; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 281657; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 281729; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 281788; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 285142; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 333789; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 333859; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 333953; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 334145; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 336881; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 337502; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 373980; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 415996; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 420702; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 515967; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 692412; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 973892; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 985754; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 989190; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 991320; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 991980; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 994404; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1001021; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1003894; code bytes = 80304a:T745,Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp")4b:T98c,Found system information discovery API: "ExpandEnvironmentStringsA" in file "setup360_100100507_4001959_csMNFx8p.exe" Found system information discovery API: "GetEnvironmentStringsW" in file "setup360_100100507_4001959_csMNFx8p.exe" Found system information discovery API: "GetMonitorInfoW" in file "setup360_100100507_4001959_csMNFx8p.exe" Found system information discovery API: "GetUserObjectInformationA" in file "setup360_100100507_4001959_csMNFx8p.exe" Found system information discovery API: "GetEnvironmentStrings" in file "setup360_100100507_4001959_csMNFx8p.exe" Found system information discovery API: "GetSystemInfo" in file "setup360_100100507_4001959_csMNFx8p.exe" Found system information discovery API: "GetUserObjectInformationA" in "00000000-00004680.00000000.174800.00400000.00000040.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00004680.00000000.174800.00400000.00000040.mdmp" Found system information discovery API: "GetUserObjectInformationA" in "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsA" in "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00005696.00000000.158764.731FA000.00000002.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00005696.00000000.158764.731FA000.00000002.mdmp" Found system information discovery API: "ZwQuerySystemInformation" in "00000000-00005696.00000000.158764.731FA000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00005696.00000000.158764.731FA000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00005696.00000000.158764.731FA000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStrings" in "00000000-00005696.00000000.158764.731FA000.00000002.mdmp"4c:T838,Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "findwindow"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "2337617640,3924,100,,FindWindowExW,user32.dll,"00:41:50.484",RX=0,PX=0" (Indicator: "findwindow"; Source: "00000000-00005696.00000001.160683.00A20000.00000004.mdmp") Found reference to API "9011682154,3924,100,,FindWindowExW,user32.dll,"00:41:49.109",RX=0,PX=0" (Indicator: "findwindow"; Source: "00000000-00005696.00000001.160683.00A20000.00000004.mdmp")4d:T795,Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp")4e:T615,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "2337617640,3924,100,,FindWindowExW,user32.dll,"00:41:50.484",RX=0,PX=0" (Indicator: "FindWindow"; Source: "00000000-00005696.00000001.160683.00A20000.00000004.mdmp") Found reference to API "9011682154,3924,100,,FindWindowExW,user32.dll,"00:41:49.109",RX=0,PX=0" (Indicator: "FindWindow"; Source: "00000000-00005696.00000001.160683.00A20000.00000004.mdmp")4f:T12ef,Found reference to API "VerifyVersionInfoA" (Indicator: "VerifyVersionInfo"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "VerifyVersionInfoA" (Indicator: "VerifyVersionInfo"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "0428012600,5308,3024,,RtlGetVersion,NTDLL.dll,"00:41:20.515",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00005696.00000000.158764.00A20000.00000004.mdmp") Found reference to API "0441124570,5308,3024,,RtlGetVersion,NTDLL.dll,"00:41:20.515",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00005696.00000000.158764.00A20000.00000004.mdmp") Found reference to API "0438823476,5308,3024,,RtlGetVersion,NTDLL.dll,"00:41:20.515",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00005696.00000000.158764.00A20000.00000004.mdmp") Found reference to API "152140764,6828,3024,,RtlGetVersion,NTDLL.dll,"00:41:17.062",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00005696.00000000.158764.00A20000.00000004.mdmp") Found reference to API "2658740118,7544,3024,,RtlGetVersion,NTDLL.dll,"00:41:50.625",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00005696.00000001.160683.00A20000.00000004.mdmp") Found reference to API "2661651372,7544,3024,,RtlGetVersion,NTDLL.dll,"00:41:50.625",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00005696.00000001.160683.00A20000.00000004.mdmp") Found reference to API "2210784788,6232,3024,,RtlGetVersion,NTDLL.dll,"00:41:50.437",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00005696.00000001.160683.00A20000.00000004.mdmp") Found reference to API "2399396508,6972,3024,,RtlGetVersion,NTDLL.dll,"00:41:50.515",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00005696.00000001.160683.00A20000.00000004.mdmp") Found reference to API "1723655374,6972,3024,,RtlGetVersion,NTDLL.dll,"00:41:50.234",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00005696.00000001.160683.00A20000.00000004.mdmp") Found reference to API "54087356388,7544,3024,,RtlGetVersion,NTDLL.dll,"00:42:20.375",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00005696.00000002.162605.00A20000.00000004.mdmp") Found reference to API "54796744636,6232,3024,,RtlGetVersion,NTDLL.dll,"00:42:20.671",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00005696.00000002.162605.00A20000.00000004.mdmp") Found reference to API "54683113792,7544,3024,,RtlGetVersion,NTDLL.dll,"00:42:20.625",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00005696.00000002.162605.00A20000.00000004.mdmp") Found reference to API "54272574014,6972,3024,,RtlGetVersion,NTDLL.dll,"00:42:20.453",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00005696.00000002.162605.00A20000.00000004.mdmp") Found reference to API "53522596020,6232,3024,,RtlGetVersion,NTDLL.dll,"00:42:20.140",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00005696.00000002.162605.00A20000.00000004.mdmp") Found reference to API "54798824258,6232,3024,,RtlGetVersion,NTDLL.dll,"00:42:20.671",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00005696.00000002.162605.00A20000.00000004.mdmp") Found reference to API "53674810418,6972,3024,,RtlGetVersion,NTDLL.dll,"00:42:20.203",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00005696.00000002.162605.00A20000.00000004.mdmp") Found reference to API "53448018256,7544,3024,,RtlGetVersion,NTDLL.dll,"00:42:20.109",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00005696.00000002.162605.00A20000.00000004.mdmp")50:T549,Found reference to API "PathFileExistsW" (Indicator: "PathFileExist"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "FSPathFileExistsW" (Indicator: "PathFileExist"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "FSPathFileExists" (Indicator: "PathFileExist"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "PathFileExistsA" (Indicator: "PathFileExist"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "PathFileExistsW" (Indicator: "PathFileExist"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "FSPathFileExistsW" (Indicator: "PathFileExist"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "FSPathFileExists" (Indicator: "PathFileExist"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "PathFileExistsW" (Indicator: "PathFileExist"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "PathFileExistsA" (Indicator: "PathFileExist"; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp")51:T158f,"setup360__100100507_4001959_csMNFx8p.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00005696-00000C17-1467449524 "setup360__100100507_4001959_csMNFx8p.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00005696-00000C17-1467458133 "setup360__100100507_4001959_csMNFx8p.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00005696-00000C17-1467460597 "setup360__100100507_4001959_csMNFx8p.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00005696-00000C17-1467463173 "setup360__100100507_4001959_csMNFx8p.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00005696-00000C17-1467465897 "setup360__100100507_4001959_csMNFx8p.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00005696-00000C17-1467468502 "setup360__100100507_4001959_csMNFx8p.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00005696-00000C17-1467471374 "setup360__100100507_4001959_csMNFx8p.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00005696-00000C17-1467474154 "setup360__100100507_4001959_csMNFx8p.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00005696-00000C17-1467476869 "setup360__100100507_4001959_csMNFx8p.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00005696-00000C17-1467479428 "setup360__100100507_4001959_csMNFx8p.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00005696-00000C17-1467481937 "setup360__100100507_4001959_csMNFx8p.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00005696-00000C17-1467484448 "setup360__100100507_4001959_csMNFx8p.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00005696-00000C17-1467486961 "setup360__100100507_4001959_csMNFx8p.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00005696-00000C17-1467489450 "setup360__100100507_4001959_csMNFx8p.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00005696-00000C17-1467491924 "setup360__100100507_4001959_csMNFx8p.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00005696-00000C17-1467494430 "setup360__100100507_4001959_csMNFx8p.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00005696-00000C17-1467497302 "setup360__100100507_4001959_csMNFx8p.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMonoItalic.ttf" at 00000000-00005696-00000C17-1467499890 "setup360__100100507_4001959_csMNFx8p.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMonoItalic.ttf" at 00000000-00005696-00000C17-1467502490 "setup360__100100507_4001959_csMNFx8p.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMonoItalic.ttf" at 00000000-00005696-00000C17-1467505102 "setup360__100100507_4001959_csMNFx8p.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00005696-00000C17-1467507787 "setup360__100100507_4001959_csMNFx8p.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMonoItalic.ttf" at 00000000-00005696-00000C17-1467517174 "setup360__100100507_4001959_csMNFx8p.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMonoItalic.ttf" at 00000000-00005696-00000C17-1467521181 "setup360__100100507_4001959_csMNFx8p.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMonoItalic.ttf" at 00000000-00005696-00000C17-1467524377 "setup360__100100507_4001959_csMNFx8p.exe" queries volume information of "C:\Windows\Fonts\ariali.ttf" at 00000000-00005696-00000C17-146754084252:T9b2,"setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADSAFE") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\AGB.EXE") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\HIVESOFT_IS1") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\HIVESOFT_IS1") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\360SD.EXE") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\GOOGLE CHROME") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\GOOGLE CHROME") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\GOOGLE CHROME"; Key: "INSTALLLOCATION") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\FIREFOX.EXE") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\GREENBROWSER_IS1") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\GREENBROWSER_IS1") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{2C8D77CD-8E98-4EFE-A693-76C864FB7096}_IS1") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{2C8D77CD-8E98-4EFE-A693-76C864FB7096}_IS1") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\THEWORLD CHROME") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\360SAFE.EXE")53:T628,Found registry modification API: "RegCreateKeyExW" in file "setup360_100100507_4001959_csMNFx8p.exe" Found registry modification API: "BRegCreateKeyExW" in file "setup360_100100507_4001959_csMNFx8p.exe" Found registry modification API: "BRegCreateKeyEx" in file "setup360_100100507_4001959_csMNFx8p.exe" Found registry modification API: "BRegCreateKeyW" in file "setup360_100100507_4001959_csMNFx8p.exe" Found registry modification API: "BRegCreateKey" in file "setup360_100100507_4001959_csMNFx8p.exe" Found registry modification API: "RegCreateKeyW" in file "setup360_100100507_4001959_csMNFx8p.exe" Found registry modification API: "BRegCreateKeyExW" in "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp" Found registry modification API: "BRegCreateKeyEx" in "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp" Found registry modification API: "BRegCreateKeyW" in "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp" Found registry modification API: "BRegCreateKey" in "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp" Found registry modification API: "RegCreateKeyExW" in "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp" Found registry modification API: "RegCreateKeyW" in "00000000-00005696.00000000.158764.731FA000.00000002.mdmp"54:T630,Found string "FSMoveFileExW" (Indicator: "MoveFileExW"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found string "FSMoveFileExA" (Indicator: "MoveFileExA"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found string "FSMoveFileW" (Indicator: "MoveFileW"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found string "FSMoveFileA" (Indicator: "MoveFileA"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found string "MoveFileExW" (Indicator: "MoveFileExW"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found string "MoveFileW" (Indicator: "MoveFileW"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found string "FSMoveFileExW" (Indicator: "MoveFileExW"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string "FSMoveFileExA" (Indicator: "MoveFileExA"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string "FSMoveFileW" (Indicator: "MoveFileW"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string "FSMoveFileA" (Indicator: "MoveFileA"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string "MoveFileExW" (Indicator: "MoveFileExW"; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string "MoveFileW" (Indicator: "MoveFileW"; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp")55:T6c1,"setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "")56:T6cb,Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "FSCreateFileW" (Indicator: "CreateFile"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "FSCreateFile" (Indicator: "CreateFile"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "FSCreateFileW" (Indicator: "CreateFile"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "FSCreateFile" (Indicator: "CreateFile"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp")57:T42a,WaitForSingleObject@KERNEL32.dll at 14307-1711-0040DB30 Sleep@KERNEL32.dll at 14307-2216-00485750 WaitForSingleObject@KERNEL32.dll at 14307-2255-00499780 Sleep@KERNEL32.dll at 14307-2456-00459B9D SleepEx@KERNEL32.dll at 14307-2597-00495FA0 WaitForSingleObject@KERNEL32.dll at 14307-3195-0040DD50 WaitForSingleObject@KERNEL32.dll at 14307-3270-00444C60 WaitForSingleObject@KERNEL32.dll at 14307-3633-00440730 WaitForSingleObject@KERNEL32.dll at 14307-3634-0043D010 SetTimer at 14307-3700-0043C330 WaitForSingleObject@KERNEL32.dll at 14307-3706-00403C30 Sleep@KERNEL32.dll at 14307-3712-004031A0 Sleep@KERNEL32.dll at 14307-3717-00403300 WaitForSingleObject@KERNEL32.dll at 14307-3719-0042D280 SetTimer at 14307-3784-0043D230 Sleep@KERNEL32.dll at 14307-3927-00434BB0 Sleep@KERNEL32.dll at 14307-4182-00425D50 WaitForSingleObject@KERNEL32.dll at 14307-5032-00405600 WaitForSingleObject@KERNEL32.dll at 14307-5033-004055E0 Sleep@KERNEL32.dll at 14307-5205-00443C10 Sleep@KERNEL32.dll at 14307-5490-00459A85 Sleep@KERNEL32.dll at 14307-5866-004B0F3658:T9f7,Found reference to API "FindResourceExW" (Indicator: "FindResource"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp")59:T690,Found reference to API "FSMoveFileExW" (Indicator: "MoveFile"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "FSMoveFileExA" (Indicator: "MoveFile"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "FSMoveFileW" (Indicator: "MoveFile"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "FSMoveFileA" (Indicator: "MoveFile"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "MoveFileExW" (Indicator: "MoveFile"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "MoveFileW" (Indicator: "MoveFile"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "FSMoveFileExW" (Indicator: "MoveFile"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "FSMoveFileExA" (Indicator: "MoveFile"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "FSMoveFileW" (Indicator: "MoveFile"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "FSMoveFileA" (Indicator: "MoveFile"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "MoveFileExW" (Indicator: "MoveFile"; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "MoveFileW" (Indicator: "MoveFile"; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp")5a:T579,Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "NtSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp")5b:T464,Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "WSASetLastError" (Indicator: "SetLastError"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp")5c:T47b,Found reference to API "ShowWindow" (Indicator: "ShowWindow"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "GetShellWindow" (Indicator: "GetShellWindow"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "GetShellWindow" (Indicator: "GetShellWindow"; Source: "00000000-00005696.00000000.158764.731FA000.00000002.mdmp")5d:T79a,"360ini.dll" contains export function called "BrowserLaunch" at ordinal 104 "360ini.dll" contains export function called "Do505_Impl" at ordinal 105 "360ini.dll" contains export function called "Is360ZipExist" at ordinal 106 "360ini.dll" contains export function called "IsBrowserInstalled" at ordinal 108 "360ini.dll" contains export function called "IsBrowserInstalled2" at ordinal 107 "360ini.dll" contains export function called "IsDesktopLiteExist" at ordinal 109 "360ini.dll" contains export function called "IsInDenyPidList" at ordinal 110 "360ini.dll" contains export function called "IsNeedInstallSafe" at ordinal 111 "360ini.dll" contains export function called "IsPalmInputExist" at ordinal 112 "360ini.dll" contains export function called "IsSDExist" at ordinal 113 "360ini.dll" contains export function called "IsSafeExist" at ordinal 115 "360ini.dll" contains export function called "IsSafeExist2" at ordinal 114 "360ini.dll" contains export function called "Report_D5S" at ordinal 116 "360ini.dll" contains export function called "SetCurrentModuleInformations" at ordinal 117 "360ini.dll" contains export function called "Start" at ordinal 120 "360ini.dll" contains export function called "Start360Zip" at ordinal 118 "360ini.dll" contains export function called "Start360Zip_UI" at ordinal 119 "360ini.dll" contains export function called "StartBrower_UI" at ordinal 121 "360ini.dll" contains export function called "StartDesktopLite" at ordinal 122 "360ini.dll" contains export function called "StartDesktopLite_UI" at ordinal 123 "360ini.dll" contains export function called "StartPalmInput" at ordinal 124 "360ini.dll" contains export function called "StartPalmInput_UI" at ordinal 125 "360ini.dll" contains export function called "StartSD" at ordinal 126 "360ini.dll" contains export function called "StartSD_UI" at ordinal 127 "360ini.dll" contains export function called "StartSafe_UI" at ordinal 1285e:T358d,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards" in Source: setup360_100100507_4001959_csMNFx8p.exe "Software\360Safe\Liveup" in Source: setup360_100100507_4001959_csMNFx8p.exe "SOFTWARE\360Safe\360Ent" in Source: setup360_100100507_4001959_csMNFx8p.exe "Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" in Source: setup360_100100507_4001959_csMNFx8p.exe "SOFTWARE\KitTipCLSID" in Source: setup360_100100507_4001959_csMNFx8p.exe "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe" in Source: setup360_100100507_4001959_csMNFx8p.exe "SOFTWARE\360MachineSignature" in Source: setup360_100100507_4001959_csMNFx8p.exe "SOFTWARE\360Safe\Liveup" in Source: setup360_100100507_4001959_csMNFx8p.exe "SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}" in Source: setup360_100100507_4001959_csMNFx8p.exe "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe" in Source: 00000000-00004680.00000000.174800.00400000.00000040.mdmp "SOFTWARE\360Safe\menuext\LiveUpdate360" in Source: 00000000-00004680.00000000.174800.00400000.00000040.mdmp "SOFTWARE\360Safe\KeepAlive\360PayInsure" in Source: 00000000-00004680.00000000.174800.00400000.00000040.mdmp "SOFTWARE\360Safe\360krnlsvc\softmgrs" in Source: 00000000-00004680.00000000.174800.00400000.00000040.mdmp "SOFTWARE\360MachineSignature" in Source: 00000000-00004680.00000000.174800.00400000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards" in Source: 00000000-00004680.00000000.174800.00400000.00000040.mdmp "Software\360Safe\Liveup" in Source: 00000000-00004680.00000000.174800.00400000.00000040.mdmp "SOFTWARE\360Safe\360Ent" in Source: 00000000-00005696.00000000.158764.00489000.00000002.mdmp 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" in Source: 00000000-00005696.00000000.158764.00489000.00000002.mdmp "SOFTWARE\KitTipCLSID" in Source: 00000000-00005696.00000000.158764.00489000.00000002.mdmp 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe" in Source: 00000000-00005696.00000000.158764.00489000.00000002.mdmp 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\360MachineSignature" in Source: 00000000-00005696.00000000.158764.00489000.00000002.mdmp 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards" in Source: 00000000-00005696.00000000.158764.00489000.00000002.mdmp 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\360Safe\Liveup" in Source: 00000000-00005696.00000000.158764.00489000.00000002.mdmp 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}" in Source: 00000000-00005696.00000000.158764.00489000.00000002.mdmp 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "Software\360Safe\Liveup" in Source: 00000000-00005696.00000000.158764.00489000.00000002.mdmp 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\Classes\PROTOCOLS\Filter\text/html" in Source: 00000000-00005696.00000000.158764.00A20000.00000004.mdmp 00000000-00005696.00000001.160683.00A20000.00000004.mdmp 00000000-00005696.00000002.162605.00A20000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005696.00000000.158764.00A20000.00000004.mdmp 00000000-00005696.00000001.160683.00A20000.00000004.mdmp 00000000-00005696.00000002.162605.00A20000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005696.00000000.158764.00A20000.00000004.mdmp 00000000-00005696.00000001.160683.00A20000.00000004.mdmp 00000000-00005696.00000002.162605.00A20000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Compression" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\Registry\MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\Registry\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySide" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\REG\REGISTRY\MACHINE\Software\WOW6432Node\M\Registry\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySide" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Setup" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Setup" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\R\REGISTRY\MACHINE\SOFTWARE\WOW\R\REGISTRY\MACHINE\Softwa\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Setup" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\RE\REGISTRY\MACHINE\Software\WOW6432\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\REGISTRY\USE\REGISTRY\MACHINE\Sof\REGISTRY\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\NonEnum" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\REGISTR\REGISTRY\MACHINE\Software\WOW6432No\\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\NonEnum" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVer\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Setup" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "Software\360iniconfig_elfsnow" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\360Safe\stat" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\360Safe\safemon" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\{A36O90FC-9D81-43B1-8A3C-82802F608193}" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "Software\Classes\Folder\shell\open\command" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "Software\Classes\ms-settings\shell\open\command" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\PalmInput" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360DesktopLite.exe" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\360zip\InstallPath" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\360Safe\Coop" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\360Safe\menuext\LiveUpdate360" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\360Safe\KeepAlive\360PayInsure" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\360Safe\360krnlsvc\softmgrs" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360sd.exe" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SoftWare\360safe\Stat" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\360Safe" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\360SelfProtection" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "Software\360\360se6\Chrome" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "Software\360\360se6\Update\ClientState\{02E720BD-2B50-4404-947C-65DBE64F6970}" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360sd.exe" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\360sd.exe" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\REGISTRY\USER\S-1-5\REGISTRY\MACHINE\Software\WOW\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\360sd.exe" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\R\REGISTRY\MACH\REGISTRY\M\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Classes\Local Settings\MuiCache\6b\52C64B7E" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\Registry\Machine\Software\WOW6432Node\Microsoft\LanguageOverlay\OverlayPackages\en-US" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\R\REGISTRY\MA\REGISTRY\MACHINE\Software\WOW6432N\Registry\Machine\Software\WOW6432Node\Microsoft\LanguageOverlay\OverlayPackages\en-US" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\360iniconfig_elfsnow" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\RE\REGISTRY\MAC\REGISTRY\MACHINE\REGIST\Registry\Machine\Software\WOW6432Node\Microsoft\LanguageOverlay\OverlayPackages\en-US" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "Software\Classes\Local Settings\MuiCache\6b\52C64B7E" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\REGISTRY\USE\REGISTRY\MACHINE\Sof\REG\Regist\REGISTRY\MA\\Registry\Machine\Software\WOW6432Node\Microsoft\LanguageOverlay\OverlayPackages\en-US" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\MUI\StringCacheSettings" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\REGISTR\REG\REGISTRY\MACHINE\Software\WOW6432N\Registry\Machine\Software\WOW6432Node\Microsoft\LanguageOverlay\OverlayPackages\en-US" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindLocalizedName\LocalizedNames" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindLocalizedName\LocalizedNames" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\REGISTRY\MACHIN\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindLocalizedName\LocalizedNames" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\RE\REGISTRY\USER\S-1-5\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindLocalizedName\LocalizedNames" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp5f:T990,Process setup360__100100507_4001959_csMNFx8p.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5696:168:WilStaging_02" Process setup360__100100507_4001959_csMNFx8p.exe created mutex with name "1830B7BD-F7A3-4c4d-989B-C004DE465EDE 5696" Process setup360__100100507_4001959_csMNFx8p.exe created mutex with name "Local\SM0:5696:64:WilError_03" Process setup360__100100507_4001959_csMNFx8p.exe created mutex with name "{EF05DB74-1623-48f2-B923-8738727916C1}" Process setup360__100100507_4001959_csMNFx8p.exe created mutex with name "Local\ZonesCacheCounterMutex" Process setup360__100100507_4001959_csMNFx8p.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process setup360__100100507_4001959_csMNFx8p.exe created mutex with name "Local\SM0:5696:168:WilStaging_02" Process setup360__100100507_4001959_csMNFx8p.exe created mutex with name "{A2CE3D3C-15E7-4985-B2C5-58F681DD07A5}" Process setup360__100100507_4001959_csMNFx8p.exe created mutex with name "SM0:5696:64:WilError_03" Process setup360__100100507_4001959_csMNFx8p.exe created mutex with name "SM0:5696:168:WilStaging_02" Process setup360__100100507_4001959_csMNFx8p.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5696:64:WilError_03" Process setup360__100100507_4001959_csMNFx8p.exe created mutex with name "\Sessions\1\BaseNamedObjects\{A2CE3D3C-15E7-4985-B2C5-58F681DD07A5}" Process setup360__100100507_4001959_csMNFx8p.exe created mutex with name "\Sessions\1\BaseNamedObjects\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 5696" Process setup360__100100507_4001959_csMNFx8p.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5696:64:WilError_03" Process setup360__100100507_4001959_csMNFx8p.exe created mutex with name "\Sessions\1\BaseNamedObjects\{EF05DB74-1623-48f2-B923-8738727916C1}" Process setup360__100100507_4001959_csMNFx8p.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5696:168:WilStaging_02" Process setup360__100100507_4001959_csMNFx8p.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process setup360__100100507_4001959_csMNFx8p.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process zoolsfCkUdFaJ19.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4680:168:WilStaging_02" Process zoolsfCkUdFaJ19.exe created mutex with name "Local\SM0:4680:168:WilStaging_02"60:T173e,Found string "User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; InstSoft)" (Indicator: "mozilla/5.0 ("; File: "setup360_100100507_4001959_csMNFx8p.exe") Found string "User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; InstSoft)" (Indicator: "user-agent: "; File: "setup360_100100507_4001959_csMNFx8p.exe") Found string "User-Agent: %s" (Indicator: "user-agent: "; File: "setup360_100100507_4001959_csMNFx8p.exe") Found string "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; InstSoft)" (Indicator: "mozilla/5.0 ("; File: "setup360_100100507_4001959_csMNFx8p.exe") Found string "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CL" (Indicator: "mozilla/4.0 ("; Source: "00000000-00005696-00000C9E-2103375704") Found string "User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found string "User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" (Indicator: "user-agent: "; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; InstSoft)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.00A20000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; InstSoft)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.00A20000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; InstSoft)" (Indicator: "user-agent: "; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.00A20000.00000004.mdmp") Found string "User-Agent: %s" (Indicator: "user-agent: "; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/7.0)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00005696.00000000.158764.00A20000.00000004.mdmp, 00000000-00005696.00000001.160683.00A20000.00000004.mdmp, 00000000-00005696.00000002.162605.00A20000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00005696.00000000.158764.00A20000.00000004.mdmp, 00000000-00005696.00000001.160683.00A20000.00000004.mdmp, 00000000-00005696.00000002.162605.00A20000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko" (Indicator: "mozilla/5.0 ("; Source: "00000000-00005696.00000000.158764.00A20000.00000004.mdmp, 00000000-00005696.00000001.160683.00A20000.00000004.mdmp, 00000000-00005696.00000002.162605.00A20000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; rv:11.0) like Gecko" (Indicator: "mozilla/5.0 ("; Source: "00000000-00005696.00000000.158764.00A20000.00000004.mdmp, 00000000-00005696.00000001.160683.00A20000.00000004.mdmp, 00000000-00005696.00000002.162605.00A20000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 6.2; WOW64; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.9200" (Indicator: "mozilla/5.0 ("; Source: "00000000-00005696.00000000.158764.00A20000.00000004.mdmp, 00000000-00005696.00000001.160683.00A20000.00000004.mdmp, 00000000-00005696.00000002.162605.00A20000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.9200" (Indicator: "mozilla/5.0 ("; Source: "00000000-00005696.00000000.158764.00A20000.00000004.mdmp, 00000000-00005696.00000001.160683.00A20000.00000004.mdmp, 00000000-00005696.00000002.162605.00A20000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 7.0; Windows Phone OS 7.0; Trident/3.1; IEMobile/7.0)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00005696.00000000.158764.00A20000.00000004.mdmp, 00000000-00005696.00000001.160683.00A20000.00000004.mdmp, 00000000-00005696.00000002.162605.00A20000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 8.0; Windows Phone OS 7.5; Trident/4.0; IEMobile/8.0)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00005696.00000000.158764.00A20000.00000004.mdmp, 00000000-00005696.00000001.160683.00A20000.00000004.mdmp, 00000000-00005696.00000002.162605.00A20000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 9.0; Windows Phone OS 7.5; Trident/5.0; IEMobile/9.0)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00005696.00000000.158764.00A20000.00000004.mdmp, 00000000-00005696.00000001.160683.00A20000.00000004.mdmp, 00000000-00005696.00000002.162605.00A20000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 10.0; Windows Phone 8.0; Trident/6.0; IEMobile/10.0; ARM; Touch)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00005696.00000000.158764.00A20000.00000004.mdmp, 00000000-00005696.00000001.160683.00A20000.00000004.mdmp, 00000000-00005696.00000002.162605.00A20000.00000004.mdmp") Found string "Mozilla/5.0 (Windows Phone 8.1; ARM; Trident/8.0; Touch; rv:11.0; IEMobile/11.0) like Gecko" (Indicator: "mozilla/5.0 ("; Source: "00000000-00005696.00000000.158764.00A20000.00000004.mdmp, 00000000-00005696.00000001.160683.00A20000.00000004.mdmp, 00000000-00005696.00000002.162605.00A20000.00000004.mdmp")61:T3547,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards" in Source: 00000000-00004680.00000000.174800.00400000.00000040.mdmp "Software\360Safe\Liveup" in Source: 00000000-00004680.00000000.174800.00400000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe" in Source: 00000000-00004680.00000000.174800.00400000.00000040.mdmp "SOFTWARE\360Safe\menuext\LiveUpdate360" in Source: 00000000-00004680.00000000.174800.00400000.00000040.mdmp "SOFTWARE\360Safe\KeepAlive\360PayInsure" in Source: 00000000-00004680.00000000.174800.00400000.00000040.mdmp "SOFTWARE\360Safe\360krnlsvc\softmgrs" in Source: 00000000-00004680.00000000.174800.00400000.00000040.mdmp "SOFTWARE\360MachineSignature" in Source: 00000000-00004680.00000000.174800.00400000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards" in Source: 00000000-00005696.00000000.158764.00489000.00000002.mdmp "Software\360Safe\Liveup" in Source: 00000000-00005696.00000000.158764.00489000.00000002.mdmp "SOFTWARE\360Safe\360Ent" in Source: 00000000-00005696.00000000.158764.00489000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" in Source: 00000000-00005696.00000000.158764.00489000.00000002.mdmp "SOFTWARE\KitTipCLSID" in Source: 00000000-00005696.00000000.158764.00489000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe" in Source: 00000000-00005696.00000000.158764.00489000.00000002.mdmp "SOFTWARE\360MachineSignature" in Source: 00000000-00005696.00000000.158764.00489000.00000002.mdmp "SOFTWARE\360Safe\Liveup" in Source: 00000000-00005696.00000000.158764.00489000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}" in Source: 00000000-00005696.00000000.158764.00489000.00000002.mdmp "SOFTWARE\Classes\PROTOCOLS\Filter\text/html" in Source: 00000000-00005696.00000000.158764.00A20000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005696.00000000.158764.00A20000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005696.00000000.158764.00A20000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Compression" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\Registry\MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\Registry\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySide" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\REG\REGISTRY\MACHINE\Software\WOW6432Node\M\Registry\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySide" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Setup" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Setup" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\R\REGISTRY\MACHINE\SOFTWARE\WOW\R\REGISTRY\MACHINE\Softwa\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Setup" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\RE\REGISTRY\MACHINE\Software\WOW6432\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\REGISTRY\USE\REGISTRY\MACHINE\Sof\REGISTRY\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\NonEnum" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\REGISTR\REGISTRY\MACHINE\Software\WOW6432No\\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\NonEnum" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVer\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Setup" in Source: 00000000-00005696.00000000.158764.02980000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "Software\360Safe\Liveup" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "Software\360iniconfig_elfsnow" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\360Safe\stat" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\360Safe\safemon" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\360Safe\360Ent" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\KitTipCLSID" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\{A36O90FC-9D81-43B1-8A3C-82802F608193}" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "Software\Classes\Folder\shell\open\command" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "Software\Classes\ms-settings\shell\open\command" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\PalmInput" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360DesktopLite.exe" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\360zip\InstallPath" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\360Safe\Coop" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\360Safe\menuext\LiveUpdate360" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\360Safe\KeepAlive\360PayInsure" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\360Safe\360krnlsvc\softmgrs" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360sd.exe" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SoftWare\360safe\Stat" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\360Safe\Liveup" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\360Safe" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\360SelfProtection" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "Software\360\360se6\Chrome" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "Software\360\360se6\Update\ClientState\{02E720BD-2B50-4404-947C-65DBE64F6970}" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\360MachineSignature" in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp "SOFTWARE\Classes\PROTOCOLS\Filter\text/html" in Source: 00000000-00005696.00000001.160683.00A20000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005696.00000001.160683.00A20000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005696.00000001.160683.00A20000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360sd.exe" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\360sd.exe" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\REGISTRY\USER\S-1-5\REGISTRY\MACHINE\Software\WOW\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\360sd.exe" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\R\REGISTRY\MACH\REGISTRY\M\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Classes\Local Settings\MuiCache\6b\52C64B7E" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\Registry\Machine\Software\WOW6432Node\Microsoft\LanguageOverlay\OverlayPackages\en-US" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\R\REGISTRY\MA\REGISTRY\MACHINE\Software\WOW6432N\Registry\Machine\Software\WOW6432Node\Microsoft\LanguageOverlay\OverlayPackages\en-US" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\360iniconfig_elfsnow" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\RE\REGISTRY\MAC\REGISTRY\MACHINE\REGIST\Registry\Machine\Software\WOW6432Node\Microsoft\LanguageOverlay\OverlayPackages\en-US" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "Software\Classes\Local Settings\MuiCache\6b\52C64B7E" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\REGISTRY\USE\REGISTRY\MACHINE\Sof\REG\Regist\REGISTRY\MA\\Registry\Machine\Software\WOW6432Node\Microsoft\LanguageOverlay\OverlayPackages\en-US" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\MUI\StringCacheSettings" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\REGISTR\REG\REGISTRY\MACHINE\Software\WOW6432N\Registry\Machine\Software\WOW6432Node\Microsoft\LanguageOverlay\OverlayPackages\en-US" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindLocalizedName\LocalizedNames" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindLocalizedName\LocalizedNames" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\REGISTRY\MACHIN\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindLocalizedName\LocalizedNames" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "\RE\REGISTRY\USER\S-1-5\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindLocalizedName\LocalizedNames" in Source: 00000000-00005696.00000001.160683.02980000.00000004.mdmp "SOFTWARE\Classes\PROTOCOLS\Filter\text/html" in Source: 00000000-00005696.00000002.162605.00A20000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005696.00000002.162605.00A20000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005696.00000002.162605.00A20000.00000004.mdmp62:T3e35,"GET /safe/instcomp.htm?type=onebox_setup&act=3&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: s.360.cn Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Sun 11 Oct 2026 07:52:28 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Tue 26 Feb 2019 07:22:31 GMT Connection: keep-alive ETag: "5c74e937-0" Accept-Ranges: bytes with no response body "GET /gf/360ini.cab HTTP/1.1 User-Agent: Beacon Host: sfdl.360safe.com Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Sun 11 Oct 2026 07:52:29 GMT Content-Type: application/octet-stream Content-Length: 2285393 Connection: keep-alive Last-Modified: Tue 15 Sep 2026 10:31:04 GMT KCS-Via: HIT from w-f04.lato;MISS from back-f04.dl.lato;EXPIRED from - K-Cache-status: MISS Accept-Ranges: bytes x-via: 1.1 PSrbdjTYO3ff160:2 (Cdn Cache Server V2.0) 1.1 PSrbdjTYO3ff160:6 (Cdn Cache Server V2.0) 1.1 PS-BOS-01n2m37:12 (Cdn Cache Server V2.0) x-ws-request-id: 6acb403d_PS-BOS-01n2m37_29590-36412 Cache-Control: s-maxage=600 max-age=600 Age: 1 Expires: Sun 11 Oct 2026 08:02:28 GMT with response body ==>4D5343460000000051C39F2200000000002C0000000000000003010100010000000000000047000000C28B000100005545000000000000002F5D35C293200033....... "GET /client/dc?m2=23f0ef3958accbbb543a1067d28c805f479293382b7e×trap=1791705540&version=1.0.0.1151&sign=7559a1b67eb038c285d2f55c50f6a005 HTTP/1.1 Host: bapi.safe.360.cn Accept: */* Pragma: no-cache Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Sun 11 Oct 2026 07:52:29 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close with response body ==>7B226572726E6F223A302C226572726D7367223A22222C2264617461223A7B226C697374223A7B22736F6674696473223A5B2232303030303036363835225D7D....... "GET /soft/getinfo?info=[[100100507,"",0]] HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; InstSoft) Host: cx.soft.360.cn Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Sun 11 Oct 2026 07:52:29 GMT Content-Type: application/json;charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=0 with response body ==>7B226572726E6F223A302C226572726D7367223A22222C2264617461223A7B22313030313030353037223A7B2262616F6B755F73756263617465223A5B7B2269....... "GET /dm/72_72_100/t01709f600470d50b78.png HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; InstSoft) Host: p0.qhimg.com Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Content-Type: image/png Content-Length: 4617 Connection: keep-alive Date: Mon 03 Aug 2026 09:25:35 GMT Accept-Ranges: bytes Last-Modified: Wed 27 May 2026 09:20:33 GMT xzp: mrvhmrovmrsrmlml Expires: Sun 01 Nov 2026 09:25:35 GMT Cache-Control: s-maxage=7776000 max-age=7776000 Access-Control-Allow-Origin: * Timing-Allow-Origin: * XCS: HIT KCS-Via: HIT from w-fc01.lato;MISS from - X-Cache: Hit from cloudfront Via: 1.1 650ddcac4370b35e9c5f62ea4ced2a74.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX53-P5 X-Amz-Cf-Id: U7hHPwjCED79yQY2QLTMOrRVL9oc1GVWPQxWStXhe1cRRDzW4lxBCg== Age: 5956015 with response body ==>C289504E470D0A1A0A0000000D494844520000004800000048080600000055C3ADC2B34700000006624B474400C3BF00C3BF00C3BFC2A0C2BDC2A7C293000000....... "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=700&r=0&d=99990001 HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: zh-CN User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Host: s.360.cn" Response ==> HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Sun 11 Oct 2026 07:52:34 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Thu 01 Aug 2019 13:00:42 GMT Connection: keep-alive ETag: "5d42e27a-0" Accept-Ranges: bytes with no response body "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=705&r=0&d=99990001 HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: zh-CN User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Host: s.360.cn" Response ==> HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Sun 11 Oct 2026 07:52:34 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Thu 01 Aug 2019 13:00:41 GMT Connection: keep-alive ETag: "5d42e279-0" Accept-Ranges: bytes with no response body "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=3000&r=0&d=0 HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: zh-CN User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Host: s.360.cn" Response ==> HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Sun 11 Oct 2026 07:52:38 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Tue 26 Feb 2019 07:22:24 GMT Connection: keep-alive ETag: "5c74e930-0" Accept-Ranges: bytes with no response body "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=3001&r=0&d=0 HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: zh-CN User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Host: s.360.cn" Response ==> HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Sun 11 Oct 2026 07:52:41 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Thu 01 Aug 2019 13:00:43 GMT Connection: keep-alive ETag: "5d42e27b-0" Accept-Ranges: bytes with no response body "GET /safe/instcomp.htm?type=onebox_setup&act=6&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: s.360.cn Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Sun 11 Oct 2026 07:52:41 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Wed 24 Apr 2019 07:59:21 GMT Connection: keep-alive ETag: "5cc01759-0" Accept-Ranges: bytes with no response body "GET /main/v1/ws/dlink?channel=4001959&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e&mid=aadc6efcafa1272b7bb902eeecd9eb62×tramp=1791706384&version=1.0.0.1151&sign=0b3721c7e4e0a593a9f33b408dcf38d0 HTTP/1.1 Host: promotion.aiwork.360.cn Accept: */* Pragma: no-cache Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Sun 11 Oct 2026 07:52:43 GMT Content-Type: application/json; charset=utf-8 Content-Length: 306 Connection: keep-alive Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Origin X-Requested-With Content-Type Accept Header-Tid Access-Control-Allow-Method: POST GET OPTIONS Access-Control-Allow-Origin: * Header-Tid: 823128545a6add18edfab1553b286380 Strict-Transport-Security: max-age=31536000; includeSubDomains with response body ==>7B226572726E6F223A302C226572726D7367223A22C3A6C288C290C3A5C28AC29F222C2264617461223A7B2264685F6368616E6E656C223A22227D2C22747970....... "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=1200&r=0&d=4001959 HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: zh-CN User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Host: s.360.cn" Response ==> HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Sun 11 Oct 2026 07:52:43 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Wed 24 Apr 2019 07:59:11 GMT Connection: keep-alive ETag: "5cc0174f-0" Accept-Ranges: bytes with no response body "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=201&r=0&d=4001959 HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: zh-CN User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Host: s.360.cn" Response ==> HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Sun 11 Oct 2026 07:52:43 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Tue 26 Feb 2019 07:22:23 GMT Connection: keep-alive ETag: "5c74e92f-0" Accept-Ranges: bytes with no response body "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=234&r=0&d=4001959 HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: zh-CN User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Host: s.360.cn" Response ==> HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Sun 11 Oct 2026 07:52:44 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Wed 24 Apr 2019 08:03:05 GMT Connection: keep-alive ETag: "5cc01839-0" Accept-Ranges: bytes with no response body "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=668&r=0&d=4001959 HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: zh-CN User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Host: s.360.cn" Response ==> HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Sun 11 Oct 2026 07:52:44 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Wed 24 Apr 2019 07:59:12 GMT Connection: keep-alive ETag: "5cc01750-0" Accept-Ranges: bytes with no response body "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=722&r=0&d=4001959 HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: zh-CN User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Host: s.360.cn" Response ==> HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Sun 11 Oct 2026 07:52:45 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Thu 01 Aug 2019 13:00:42 GMT Connection: keep-alive ETag: "5d42e27a-0" Accept-Ranges: bytes with no response body "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=723&r=0&d=4001959 HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: zh-CN User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Host: s.360.cn" Response ==> HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Sun 11 Oct 2026 07:52:45 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Thu 01 Aug 2019 13:00:43 GMT Connection: keep-alive ETag: "5d42e27b-0" Accept-Ranges: bytes with no response body "GET /main/v1/silent-install/allow?ipartner=4001959&product=ws&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&only_check_reasons= HTTP/1.1 Host: kittip-api.safe.360.cn Accept: */* Pragma: no-cache Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Sun 11 Oct 2026 07:52:46 GMT Content-Type: application/json; charset=utf-8 Content-Length: 293 Connection: keep-alive Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Origin X-Requested-With Content-Type Accept Header-Tid Access-Control-Allow-Method: POST GET OPTIONS Access-Control-Allow-Origin: * Header-Tid: 570fe4215b6add18573e8618e5a4d9c6 Strict-Transport-Security: max-age=31536000; includeSubDomains with response body ==>7B226572726E6F223A302C226572726D7367223A22222C2264617461223A22465079364232484D722F6D424F7732596462307964565376762B6351655066632B....... "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=51&r=0&d=4001959 HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: zh-CN User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Host: s.360.cn" Response ==> HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Sun 11 Oct 2026 07:52:47 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Tue 26 Feb 2019 07:22:24 GMT Connection: keep-alive ETag: "5c74e930-0" Accept-Ranges: bytes with no response body "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&v=2001318&w=0&b=48&d=4001959&o=70 HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: zh-CN User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Host: s.360.cn" Response ==> HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Sun 11 Oct 2026 07:52:47 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Wed 24 Apr 2019 07:59:14 GMT Connection: keep-alive ETag: "5cc01752-0" Accept-Ranges: bytes with no response body "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=202&r=0&d=4001959 HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: zh-CN User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Host: s.360.cn" Response ==> HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Sun 11 Oct 2026 07:52:48 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Thu 01 Aug 2019 13:00:41 GMT Connection: keep-alive ETag: "5d42e279-0" Accept-Ranges: bytes with no response body "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=210&r=0&d=4001959 HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: zh-CN User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Host: s.360.cn" Response ==> HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Sun 11 Oct 2026 07:52:49 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Thu 01 Aug 2019 13:00:42 GMT Connection: keep-alive ETag: "5d42e27a-0" Accept-Ranges: bytes with no response body "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=212&r=0&d=4001959 HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: zh-CN User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Host: s.360.cn" Response ==> HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Sun 11 Oct 2026 07:52:49 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Thu 01 Aug 2019 13:00:42 GMT Connection: keep-alive ETag: "5d42e27a-0" Accept-Ranges: bytes with no response body "GET /hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=229&r=0&d=4001959 HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: zh-CN User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Host: s.360.cn" Response ==> HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Sun 11 Oct 2026 07:52:52 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Tue 26 Feb 2019 07:22:25 GMT Connection: keep-alive ETag: "5c74e931-0" Accept-Ranges: bytes with no response body "GET /hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=228&r=0&d=4001959 HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: zh-CN User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Host: s.360.cn" Response ==> HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Sun 11 Oct 2026 07:52:52 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Tue 26 Feb 2019 07:22:23 GMT Connection: keep-alive ETag: "5c74e92f-0" Accept-Ranges: bytes with no response body63:T41c,"setup360_100100507_4001959_csMNFx8p.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "setup360_100100507_4001959_csMNFx8p.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "setup360_100100507_4001959_csMNFx8p.exe" was detected as "Microsoft Linker" and name: "Linker" "360ini.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "360ini.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "360ini.dll" was detected as "Microsoft Linker" and name: "Linker" "zoolsfCkUdFaJ19.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "zoolsfCkUdFaJ19.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "zoolsfCkUdFaJ19.exe" was detected as "Microsoft Linker" and name: "Linker" "tAgXmEoSeJkBaOaV64.tmp" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "tAgXmEoSeJkBaOaV64.tmp" was detected as "Microsoft Visual C/C++" and name: "Compiler" "tAgXmEoSeJkBaOaV64.tmp" was detected as "Microsoft Linker" and name: "Linker"64:Ta09,"setup360_100100507_4001959_csMNFx8p.exe" file has an entrypoint instructions - "call 0x4687c7,jmp 0x456384,int3 ,push 0x454180,push dword ptr fs:[0],mov eax, dword ptr [esp + 0x10],mov dword ptr [esp + 0x10], ebp,lea ebp, [esp + 0x10],sub esp, eax,push ebx,push esi,push edi,mov eax, dword ptr [0x4d3b50],xor dword ptr [ebp - 4], eax,xor eax, ebp,push eax,mov dword ptr [ebp - 0x18], esp,push dword ptr [ebp - 8],mov eax, dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xfffffffe,mov dword ptr [ebp - 8], eax,lea eax, [ebp - 0x10],mov dword ptr fs:[0], eax,ret ,mov ecx, dword ptr [ebp - 0x10],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ," "360ini.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1008657f,call 0x100936af,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x10086479,pop ecx,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov edx, dword ptr [esp + 0xc],mov ecx, dword ptr [esp + 4],test edx, edx,je 0x10086615,xor eax, eax,mov al, byte ptr [esp + 8],test al, al,jne 0x100865cc,cmp edx, 0x100,jb 0x100865cc,cmp dword ptr [0x10134ae4], 0,je 0x100865cc,jmp 0x1009379c,push edi,mov edi, ecx,cmp edx, 4," "zoolsfCkUdFaJ19.exe" file has an entrypoint instructions - "mov eax, 0x417404,push eax,push dword ptr fs:[0],mov dword ptr fs:[0], esp,xor eax, eax,mov dword ptr [eax], ecx,push eax,inc ebp,inc ebx,xor al, byte ptr [eax],xor eax, 0x11840764,and edi, dword ptr [edi + 0x35c77a35],fldcw word ptr [ecx + 0x26267466],cmp eax, 0xcbac6a27,fidivr dword ptr [0xdd07e1b5],sar byte ptr [edi - 0x21464a0c], 0xac,sbb edi, dword ptr [ecx],xchg esi, eax,cmpsd dword ptr [esi], dword ptr es:[edi],je 0x401077,xlatb ,out dx, al,les esp, ptr [esi - 0x19],add eax, 0x8986df83,dec ecx,cli ,xchg edi, eax,push cs,inc ebp,loop 0x401030,xchg al, ch,mov cl, byte ptr [ecx],in eax, 0x13,push ds,mov ecx, 0xa639b3a0,push ds," "tAgXmEoSeJkBaOaV64.tmp" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180010825,call 0x1800167d8,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800106ec,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x10], rbx,push rdi,sub rsp, 0x60,mov rdi, rdx,mov rbx, rcx,lea rcx, [rsp + 0x20],lea rdx, [rip + 0x14070],mov r8d, 0x40,"65:Tb4a,"setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA-ES") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA-ES") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CS-CZ") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CS-CZ") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DA-DK") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "DA-DK") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DE-DE") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "DE-DE") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EL-GR") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EL-GR") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ES-ES_TRADNL") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ES-ES_TRADNL") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "FI-FI") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "FI-FI") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "FR-FR") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "FR-FR") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "HU-HU") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "HU-HU") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "IT-IT") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "IT-IT") "setup360__100100507_4001959_csMNFx8p.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "NL-NL")66:T845,The input sample is signed with a certificate issued by "CN=WoTrus RSA DV SSL CA 2, O=WoTrus CA Limited, C=CN" (SHA1: 93:15:BB:0C:2E:F8:5D:DF:D6:D7:2E:21:4F:13:5C:DB:5B:A7:DE:0A; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB" (SHA1: 7A:90:18:53:C4:C0:4E:7A:BF:B5:D7:A6:E6:CD:85:4C:DF:18:84:B8; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 2B:18:94:7A:6A:9F:C7:76:4F:D8:B5:FB:18:A8:63:B0:C6:DA:C2:4F; see report for more information) The input sample is signed with a certificate issued by "CN=WoTrus RSA DV SSL CA 2, O=WoTrus CA Limited, C=CN" (SHA1: 57:CE:FD:79:FF:31:4A:E8:03:C5:74:2A:D7:AD:E8:7C:29:A0:BF:7A; see report for more information) The input sample is signed with a certificate issued by "CN="WoTrus DV Server CA [Run by the Issuer]", O=WoTrus CA Limited, C=CN" (SHA1: 63:CC:73:C5:6C:28:0B:47:AC:0C:1F:75:9E:12:41:EC:D5:07:EA:EC; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: A0:42:A8:52:96:1B:90:D5:86:75:91:D0:EA:2B:99:6C:B9:EC:FE:F1; see report for more information) The input sample is signed with a certificate issued by "CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: D8:9E:3B:D4:3D:5D:90:9B:47:A1:89:77:AA:9D:5C:E3:6C:EE:18:4C; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Code Signing Root R45, O=GlobalSign nv-sa, C=BE" (SHA1: C1:0B:B7:6A:D4:EE:81:52:42:40:6A:1E:3E:11:17:FF:EC:74:3D:4F; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE" (SHA1: 79:13:DE:9D:7E:D4:EE:EE:79:0F:F0:68:0A:4C:80:2C:1B:C8:32:AB; see report for more information)67:T5de,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp")68:T14a0,"360ini.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\cShRjRnAlKqUrKuD\360ini.dll]- [targetUID: 00000000-00005696] "zoolsfCkUdFaJ19.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 PECompact2 compressed 2 sections"- [targetUID: N/A] "360ini_1_.cab" has type "Unknown"- [targetUID: N/A] "_56E18856-2C41-4092-BB21-FA37C34F71C4_" has type "Unknown"- [targetUID: N/A] "tAgXmEoSeJkBaOaV64.tmp" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\tAgXmEoSeJkBaOaV64.tmp]- [targetUID: 00000000-00005696] "_DE36F986-015A-4596-9DF1-7826386D8613_.tmp" has type "Unknown"- [targetUID: N/A] "iAbMqWtFwQeEaCeH.tmp" has type "data"- Location: [%TEMP%\{EA375CF2-F672-4f0d-9A08-D5C5C210E0E3}\iAbMqWtFwQeEaCeH.tmp]- [targetUID: 00000000-00005696] "_DFA9D2C4-7737-4cae-8AF0-66F8EC744A1B_.tmp" has type "Unknown"- [targetUID: N/A] "wTaKkScDuClLcFkJ.tmp" has type "data"- Location: [%TEMP%\wTaKkScDuClLcFkJ.tmp]- [targetUID: 00000000-00005696] "tCnRvKcMxPiXmCsG.tmp" has type "data"- Location: [%TEMP%\tCnRvKcMxPiXmCsG.tmp]- [targetUID: 00000000-00005696] "_C388D29E-7402-4b10-B05A-6D8656349490_.tmp" has type "Unknown"- [targetUID: N/A] "_142EDD5F-90E7-456d-A8AC-C4BCB90503D0_.tmp" has type "Unknown"- [targetUID: N/A] "jKpJoUaOaLaXlQdU.tmp" has type "data"- Location: [%TEMP%\jKpJoUaOaLaXlQdU.tmp]- [targetUID: 00000000-00005696] "aEzTcBkCmKdVmLfV.tmp" has type "data"- Location: [%TEMP%\aEzTcBkCmKdVmLfV.tmp]- [targetUID: 00000000-00005696] "wToKbXqMjDpTnQrZ.tmp" has type "data"- Location: [%TEMP%\wToKbXqMjDpTnQrZ.tmp]- [targetUID: 00000000-00005696] "_D4E54323-FA34-43f5-AC1E-4B9C02A1CC27_.tmp" has type "Unknown"- [targetUID: N/A] "_4A32949F-45C3-4e75-9485-3F7E8A80B5B9_.tmp" has type "Unknown"- [targetUID: N/A] "_96A45189-D683-43aa-9FBD-7E71EC5B64D6_.tmp" has type "Unknown"- [targetUID: N/A] "cFjKlTfWoEyMnTxE.tmp" has type "data"- Location: [%TEMP%\{9583EEE7-A8EF-45a8-B12A-B2ACCEF71DFA}\cFjKlTfWoEyMnTxE.tmp]- [targetUID: 00000000-00005696] "_5FDE2C7B-40F6-440c-B20E-3DDC8478DF2B_.tmp" has type "Unknown"- [targetUID: N/A] "fLpFqBsRhGgArVnV.tmp" has type "data"- Location: [%TEMP%\fLpFqBsRhGgArVnV.tmp]- [targetUID: 00000000-00005696] "_15C79E09-A104-45d8-AB59-89430F3F61A4_.tmp" has type "Unknown"- [targetUID: N/A] "_33397BD2-B7BD-4307-98A9-7F6848371C71_.tmp" has type "Unknown"- [targetUID: N/A] "_0B1C3189-F607-4afe-988E-D03DE989B182_.tmp" has type "Unknown"- [targetUID: N/A] "hMnXyNiJpSvPwUvQ.tmp" has type "data"- Location: [%TEMP%\{9A1BBA4A-C1BF-45a7-B89C-3C28F7EC345A}\hMnXyNiJpSvPwUvQ.tmp]- [targetUID: 00000000-00005696] "rReJyRfXoXaBlWfD.tmp" has type "data"- Location: [%TEMP%\{246E7342-393D-4448-8318-EEEA3041C158}\rReJyRfXoXaBlWfD.tmp]- [targetUID: 00000000-00005696] "_6761544E-10E5-402b-8E9D-19441F4A321A_.tmp" has type "Unknown"- [targetUID: N/A] "tBxOuQaZbPdFgMdZ.tmp" has type "data"- Location: [%TEMP%\{7B1BD9AD-130E-49c5-ADF7-58699C91ADA9}\tBxOuQaZbPdFgMdZ.tmp]- [targetUID: 00000000-00005696] "_6E6591EA-77BA-4d71-9B21-ADCC7645F59E_.tmp" has type "Unknown"- [targetUID: N/A] "kPyYmPeVcKdZuQuX.tmp" has type "data"- Location: [%TEMP%\kPyYmPeVcKdZuQuX.tmp]- [targetUID: 00000000-00005696] "vMhNxQqZmMzMpKmH.tmp" has type "data"- Location: [%TEMP%\vMhNxQqZmMzMpKmH.tmp]- [targetUID: 00000000-00005696] "_358E60E3-97B4-4e61-B7E1-11F3A262A6C6_.tmp" has type "Unknown"- [targetUID: N/A] "_0334FA77-0AB6-4faf-B78B-20FBFA5B0C7A_.tmp" has type "Unknown"- [targetUID: N/A] "uByHuTdFoDtWhDrQ.tmp" has type "data"- Location: [%TEMP%\{C814AC6F-9E52-46a0-91C1-46AD0AF54FFD}\uByHuTdFoDtWhDrQ.tmp]- [targetUID: 00000000-00005696] "tUuBpVvYiEdKlMtV.tmp" has type "data"- Location: [%TEMP%\{CCE4424F-4CF1-404a-8845-ACD5D480B413}\tUuBpVvYiEdKlMtV.tmp]- [targetUID: 00000000-00005696] "_DC84D1EB-987E-495b-843D-C471C0C118D2_.tmp" has type "Unknown"- [targetUID: N/A] "_FB7C9708-BBEA-4df8-85AC-D603E7BFF7CC_.tmp" has type "Unknown"- [targetUID: N/A] "_07B7A04F-D3A0-4f04-BBC6-ABB4C39F2385_.tmp" has type "Unknown"- [targetUID: N/A] "_63FF1E40-A111-4e68-8BD4-E666C1919AB1_.tmp" has type "Unknown"- [targetUID: N/A] "nGiRrFtZpMxQqNoG.tmp" has type "data"- Location: [%TEMP%\nGiRrFtZpMxQqNoG.tmp]- [targetUID: 00000000-00005696] "_IVSA2UQ" has type "Unknown"- [targetUID: N/A] "_ISAUJZ2" has type "Unknown"- [targetUID: N/A] "jIzTqXrVpOiYzDbT.tmp" has type "data"- Location: [%TEMP%\{82AF3990-9FBB-489a-925D-28D23E80B603}\jIzTqXrVpOiYzDbT.tmp]- [targetUID: 00000000-00005696] "sJjYrBdMpFjVvLgW.tmp" has type "data"- Location: [%TEMP%\{5F42191E-ED9F-46b8-A6F8-C2D5B19ADAA3}\sJjYrBdMpFjVvLgW.tmp]- [targetUID: 00000000-00005696] "eGdDyTaWtSsXjXbT.tmp" has type "data"- Location: [%TEMP%\{65B13211-0640-4aaa-A71A-4BF3A857408D}\eGdDyTaWtSsXjXbT.tmp]- [targetUID: 00000000-00005696] "hImVnGlKmDnGjLmL.tmp" has type "data"- Location: [%TEMP%\hImVnGlKmDnGjLmL.tmp]- [targetUID: 00000000-00005696] "_05742C70-FEA7-4cd6-A8EF-0CE4C813CF17_.tmp" has type "Unknown"- [targetUID: N/A] "360ini.cab" has type "Microsoft Cabinet archive data Windows 2000/XP setup 2285393 bytes 1 file at 0x2c last modified Sep 15 2026 18:25:42 +A "360InI.dll" number 1 139 datablocks 0x1 compression"- Location: [%TEMP%\360ini.cab]- [targetUID: 00000000-00005696]69:T822,"tAgXmEoSeJkBaOaV64.tmp" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections" - Location: [%TEMP%\tAgXmEoSeJkBaOaV64.tmp] "_DE36F986-015A-4596-9DF1-7826386D8613_.tmp" has type "Unknown" "iAbMqWtFwQeEaCeH.tmp" has type "data" - Location: [%TEMP%\{EA375CF2-F672-4f0d-9A08-D5C5C210E0E3}\iAbMqWtFwQeEaCeH.tmp] "_DFA9D2C4-7737-4cae-8AF0-66F8EC744A1B_.tmp" has type "Unknown" "wTaKkScDuClLcFkJ.tmp" has type "data" - Location: [%TEMP%\wTaKkScDuClLcFkJ.tmp] "tCnRvKcMxPiXmCsG.tmp" has type "data" - Location: [%TEMP%\tCnRvKcMxPiXmCsG.tmp] "_C388D29E-7402-4b10-B05A-6D8656349490_.tmp" has type "Unknown" "_142EDD5F-90E7-456d-A8AC-C4BCB90503D0_.tmp" has type "Unknown" "jKpJoUaOaLaXlQdU.tmp" has type "data" - Location: [%TEMP%\jKpJoUaOaLaXlQdU.tmp] "aEzTcBkCmKdVmLfV.tmp" has type "data" - Location: [%TEMP%\aEzTcBkCmKdVmLfV.tmp] "wToKbXqMjDpTnQrZ.tmp" has type "data" - Location: [%TEMP%\wToKbXqMjDpTnQrZ.tmp] "_D4E54323-FA34-43f5-AC1E-4B9C02A1CC27_.tmp" has type "Unknown" "_4A32949F-45C3-4e75-9485-3F7E8A80B5B9_.tmp" has type "Unknown" "_96A45189-D683-43aa-9FBD-7E71EC5B64D6_.tmp" has type "Unknown" "cFjKlTfWoEyMnTxE.tmp" has type "data" - Location: [%TEMP%\{9583EEE7-A8EF-45a8-B12A-B2ACCEF71DFA}\cFjKlTfWoEyMnTxE.tmp] "_5FDE2C7B-40F6-440c-B20E-3DDC8478DF2B_.tmp" has type "Unknown" "fLpFqBsRhGgArVnV.tmp" has type "data" - Location: [%TEMP%\fLpFqBsRhGgArVnV.tmp] "_15C79E09-A104-45d8-AB59-89430F3F61A4_.tmp" has type "Unknown" "_33397BD2-B7BD-4307-98A9-7F6848371C71_.tmp" has type "Unknown" "_0B1C3189-F607-4afe-988E-D03DE989B182_.tmp" has type "Unknown" "hMnXyNiJpSvPwUvQ.tmp" has type "data" - Location: [%TEMP%\{9A1BBA4A-C1BF-45a7-B89C-3C28F7EC345A}\hMnXyNiJpSvPwUvQ.tmp] "rReJyRfXoXaBlWfD.tmp" has type "data" - Location: [%TEMP%\{246E7342-393D-4448-8318-EEEA3041C158}\rReJyRfXoXaBlWfD.tmp] "_6761544E-10E5-402b-8E9D-19441F4A321A_.tmp" has type "Unknown" "tBxOuQaZbPdFgMdZ.tmp" has type "data" - Location: [%TEMP%\{7B1BD9AD-130E-49c5-ADF7-58699C91ADA9}\tBxOuQaZbPdFgMdZ.tmp] "_6E6591EA-77BA-4d71-9B21-ADCC7645F59E_.tmp" has type "Unknown"6a:Tae7,"setup360__100100507_4001959_csMNFx8p.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\CONTAINERS"; Key: ""; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: ""; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: ""; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: ""; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: ""; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS"; Key: ""; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: ""; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\TENCENT\QQPCMGR"; Key: ""; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\INPROCSERVER32"; Key: ""; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\INPROCSERVER32"; Key: ""; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{4DA01382-D7BB-450E-ACE4-FB3E21206402}\INPROCSERVER32"; Key: ""; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4DA01382-D7BB-450E-ACE4-FB3E21206402}\INPROCSERVER32"; Key: ""; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS"; Key: ""; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{905E63B6-C1BF-494E-B29C-65B732D3D21A}"; Key: ""; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{905E63B6-C1BF-494E-B29C-65B732D3D21A}\PROPERTYBAG"; Key: ""; Value: "")6b:T10e0,"setup360__100100507_4001959_csMNFx8p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\CONTAINERS"; Key: "SECUREAUTOPROXY"; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\CONTAINERS"; Key: "SENDDNSTOHOST"; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "WINHTTPLOWERCASEHOST"; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{905E63B6-C1BF-494E-B29C-65B732D3D21A}"; Key: "CATEGORY"; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{905E63B6-C1BF-494E-B29C-65B732D3D21A}"; Key: "NAME"; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{905E63B6-C1BF-494E-B29C-65B732D3D21A}"; Key: "PARENTFOLDER"; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{905E63B6-C1BF-494E-B29C-65B732D3D21A}"; Key: "DEFERPRECREATEANDREDIRECT"; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{905E63B6-C1BF-494E-B29C-65B732D3D21A}"; Key: "DESCRIPTION"; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{905E63B6-C1BF-494E-B29C-65B732D3D21A}"; Key: "RELATIVEPATH"; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{905E63B6-C1BF-494E-B29C-65B732D3D21A}"; Key: "PARSINGNAME_36354489"; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{905E63B6-C1BF-494E-B29C-65B732D3D21A}"; Key: "PARSINGNAME"; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{905E63B6-C1BF-494E-B29C-65B732D3D21A}"; Key: "INFOTIP"; Value: "") "setup360__100100507_4001959_csMNFx8p.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{905E63B6-C1BF-494E-B29C-65B732D3D21A}"; Key: "LOCALIZEDNAME"; Value: "")6c:T4b9,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Able to identify sandbox environment running process Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Possibly tries to evade analysis by sleeping multiple times Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Contains ability to detect sandbox (imports API) Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Makes a code branch decision directly after an API that is environment aware6d:T56a,"setup360__100100507_4001959_csMNFx8p.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "setup360__100100507_4001959_csMNFx8p.exe" trying to touch file "C:\setup360__100100507_4001959_csMNFx8p.exe" "setup360__100100507_4001959_csMNFx8p.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "setup360__100100507_4001959_csMNFx8p.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "setup360__100100507_4001959_csMNFx8p.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "setup360__100100507_4001959_csMNFx8p.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "setup360__100100507_4001959_csMNFx8p.exe" trying to touch file "C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb" "setup360__100100507_4001959_csMNFx8p.exe" trying to touch file "C:\WINDOWS\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_6ebca75c88023f94\COMCTL32.dll" "setup360__100100507_4001959_csMNFx8p.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_6ebca75c88023f94\comctl32.dll" "setup360__100100507_4001959_csMNFx8p.exe" trying to touch file "C:\VERSION.dll" "setup360__100100507_4001959_csMNFx8p.exe" trying to touch file "C:\WINDOWS\SysWOW64\VERSION.dll" "setup360__100100507_4001959_csMNFx8p.exe" trying to touch file "C:\Windows\SysWOW64\version.dll"6e:T686,"setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "C:\VERSION.dll" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "C:\WININET.dll" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "C:\urlmon.dll" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "C:\iertutil.dll" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "C:\srvcli.dll" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "C:\netutils.dll" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "C:\MSVCP140.dll" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "C:\ncrypt.dll" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "C:\NTASN1.dll" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "C:\bcrypt.dll" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "C:\MSASN1.dll" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "C:\DPAPI.DLL" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "C:\USERENV.dll" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\offline514.exe"6f:T637,"setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "\Device\RasAcd" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\mswsock.dll.mui" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\wshqos.dll.mui" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\6LDIEKEG" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\CRYPT32.dll.mui" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "BW2K" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "SUPERBPM" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "ICEDUMP" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "REGVXD" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "NTICE" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "SIWVID" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "SICE" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "FILEVXD" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "FILEMON701" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "REGMON701" "setup360__100100507_4001959_csMNFx8p.exe" trying to access non-existent file "fengyue0"70:T553,"setup360__100100507_4001959_csMNFx8p.exe" called "HttpOpenRequestW" with parameter HTTP method:"GET" object: /safe/instcomp.htm?type=onebox_setup&act=3&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa127" - (UID: 00000000-00005696), "setup360__100100507_4001959_csMNFx8p.exe" called "HttpOpenRequestW" with parameter HTTP method:"HEAD" object: /gf/360ini.cab" - (UID: 00000000-00005696) "setup360__100100507_4001959_csMNFx8p.exe" called "HttpOpenRequestW" with parameter HTTP method:"GET" object: /soft/getinfo?info=[[100100507 "" 0]]" - (UID: 00000000-00005696), "setup360__100100507_4001959_csMNFx8p.exe" called "HttpOpenRequestW" with parameter HTTP method:"GET" object: /gf/360ini.cab" - (UID: 00000000-00005696) "setup360__100100507_4001959_csMNFx8p.exe" called "HttpOpenRequestW" with parameter HTTP method:"GET" object: /dm/72_72_100/t01709f600470d50b78.png" - (UID: 00000000-00005696), "setup360__100100507_4001959_csMNFx8p.exe" called "HttpOpenRequestW" with parameter HTTP method:"GET" object: /safe/instcomp.htm?type=onebox_setup&act=6&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa127" - (UID: 00000000-00005696) "setup360__100100507_4001959_csMNFx8p.exe" called "HttpOpenRequestW" with parameter HTTP method:"GET" object: /partner/installer.exe" - (UID: 00000000-00005696)71:Tfd5,Found http requests in header "GET /safe/instcomp.htm?type=onebox_setup&act=3&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e" Found http requests in header "GET /gf/360ini.cab" Found http requests in header "GET /client/dc?m2=23f0ef3958accbbb543a1067d28c805f479293382b7e×trap=1791705540&version=1.0.0.1151&sign=7559a1b67eb038c285d2f55c50f6a005" Found http requests in header "GET /soft/getinfo?info=[[100100507,"",0]]" Found http requests in header "GET /dm/72_72_100/t01709f600470d50b78.png" Found http requests in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=700&r=0&d=99990001" Found http requests in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=705&r=0&d=99990001" Found http requests in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=3000&r=0&d=0" Found http requests in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=3001&r=0&d=0" Found http requests in header "GET /safe/instcomp.htm?type=onebox_setup&act=6&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e" Found http requests in header "GET /main/v1/ws/dlink?channel=4001959&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e&mid=aadc6efcafa1272b7bb902eeecd9eb62×tramp=1791706384&version=1.0.0.1151&sign=0b3721c7e4e0a593a9f33b408dcf38d0" Found http requests in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=1200&r=0&d=4001959" Found http requests in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=201&r=0&d=4001959" Found http requests in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=234&r=0&d=4001959" Found http requests in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=668&r=0&d=4001959" Found http requests in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=722&r=0&d=4001959" Found http requests in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=723&r=0&d=4001959" Found http requests in header "GET /main/v1/silent-install/allow?ipartner=4001959&product=ws&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&only_check_reasons=" Found http requests in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=51&r=0&d=4001959" Found http requests in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&v=2001318&w=0&b=48&d=4001959&o=70" Found http requests in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=202&r=0&d=4001959" Found http requests in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=210&r=0&d=4001959" Found http requests in header "GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=212&r=0&d=4001959" Found http requests in header "GET /hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=229&r=0&d=4001959" Found http requests in header "GET /hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=228&r=0&d=4001959"72:T980,Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp, 00000000-00005696.00000000.158764.731FA000.00000002.mdmp") Found reference to API "509801576,5308,3237,,InternetReadFile,Wininet.dll,"00:41:20.125",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005696.00000000.158764.00A20000.00000004.mdmp") Found reference to API "525429218,5308,3237,,InternetReadFile,Wininet.dll,"00:41:20.140",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005696.00000000.158764.00A20000.00000004.mdmp")73:Tf10,Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "No valid port number in connect to host string (%s)" (Indicator: " connect "; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "Couldn't bind to '%s'" (Indicator: " bind "; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "Couldn't bind to interface '%s'" (Indicator: " bind "; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "Immediate connect fail for %s: %s" (Indicator: " connect "; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "Failed to connect to %s port %ld: %s" (Indicator: " connect "; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "After %ldms connect time, move on!" (Indicator: " connect "; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "schannel: failed to send initial handshake data: sent %zd of %lu bytes" (Indicator: " send "; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "schannel: WinSSL version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc." (Indicator: " connect "; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "schannel: server indicated shutdown in a prior call" (Indicator: " shutdown "; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "schannel: failed to send close msg: %s (bytes written: %zd)" (Indicator: " send "; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "schannel: failed to send next handshake data: sent %zd of %lu bytes" (Indicator: " send "; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "Failed to receive SOCKS4 connect request ack." (Indicator: " connect "; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client." (Indicator: " connect "; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "Failed to send SOCKS4 connect request." (Indicator: " connect "; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "Failed to send SOCKS4 connect request." (Indicator: " send "; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "SOCKS4 connect to IPv4 %s (locally resolved)" (Indicator: " connect "; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "Unable to send initial SOCKS5 request." (Indicator: " send "; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "Failed to send SOCKS5 sub-negotiation request." (Indicator: " send "; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "Failed to send SOCKS5 connect request." (Indicator: " connect "; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "Failed to send SOCKS5 connect request." (Indicator: " send "; File: "setup360_100100507_4001959_csMNFx8p.exe") Found reference to API "Failed to receive SOCKS5 connect request ack." (Indicator: " connect "; File: "setup360_100100507_4001959_csMNFx8p.exe")74:T4524,Heuristic match: "ftp@example.com" Pattern match: "https://curl.haxx.se/docs/http-cookies.html#" Pattern match: "https://promotion.aiwork.360.cn/main/v1/ws/dlink" Pattern match: "https://hao.360.com/?y1026" Pattern match: "https://hao.360.com/?src=lm&ls=%s" Pattern match: "https://hao.360.com/?%s" Pattern match: "http://s.360.cn/safe/instcomp.htm?type=onebox_setup&act=%d&status=&detail=&softid=%s&popid=&ver=&enterprise=&pid=%d&mid=%s&m2=%s" Pattern match: "http://baoku.360.cn/" Pattern match: "http://cx.soft.360.cn/soft/getinfo?info=[[%s,,0" Pattern match: "https://cx.soft.360.cn/soft/getinfo?info=[[%s,,0" Pattern match: "http://baoku.360.cn/soft/show/appid/%s" Pattern match: "https://promotion.aiwork.360.cn/main/v1/ws/clientup" Pattern match: "https://local.info.g9hc4.cn:54360/?callback=uuidjsonpcbaius" Pattern match: "https://bapi.safe.360.cn/client/dc" Heuristic match: "w360.cn" Heuristic match: "360.com" Pattern match: "http://s.360.cn/safe/instcomp.htm?type=onebox_setup&act=1&status=%d&detail=%s&softid=%s&popid=&ver=%s&enterprise=%d&pid=%d&mid=%s&m2=%s" Pattern match: "http://down.360safe.com/setup.exe" Pattern match: "http://sfdl.360safe.com/gf/360ini.cab" Pattern match: "http://dl.360safe.com/gf/360ini.cab" Pattern match: "http://down.360safe.com/setupbeta.exe" Heuristic match: "360.cn" Pattern match: "promotion.aiwork.360.cn/main/v1/ws/dlink" Pattern match: "0.com/?src=lm&ls=%s" Pattern match: "s.360.cn/safe/instcomp.htm?type=onebox_setup&act=%d&status=&detail=&softid=%s&popid=&ver=&enterprise=&pid=%d&mid=%s&m2=%s" Pattern match: "baoku.360.cn/soft/show/appid/%s" Pattern match: "bapi.safe.360.cn/client/dc" Pattern match: "sfdl.360safe.com/gf/360ini.cab" Heuristic match: "sfdl.360safe.com" Heuristic match: "s.360.cn" Heuristic match: "bapi.safe.360.cn" Heuristic match: "cx.soft.360.cn" Heuristic match: "p0.qhimg.com" Heuristic match: "get /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=700&r=0&d=99990001 http/1.1accept: text/html, application/xhtml+xml, */*accept-language: zh-cnuser-agent: mozilla/5.0 (windows nt 6.1; " Heuristic match: "get /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=705&r=0&d=99990001 http/1.1accept: text/html, application/xhtml+xml, */*accept-language: zh-cnuser-agent: mozilla/5.0 (windows nt 6.1; " Heuristic match: "get /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=3000&r=0&d=0 http/1.1accept: text/html, application/xhtml+xml, */*accept-language: zh-cnuser-agent: mozilla/5.0 (windows nt 6.1; wow64;" Heuristic match: "get /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=3001&r=0&d=0 http/1.1accept: text/html, application/xhtml+xml, */*accept-language: zh-cnuser-agent: mozilla/5.0 (windows nt 6.1; wow64;" Heuristic match: "promotion.aiwork.360.cn" Heuristic match: "get /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=1200&r=0&d=4001959 http/1.1accept: text/html, application/xhtml+xml, */*accept-language: zh-cnuser-agent: mozilla/5.0 (windows nt 6.1; " Heuristic match: "get /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=201&r=0&d=4001959 http/1.1accept: text/html, application/xhtml+xml, */*accept-language: zh-cnuser-agent: mozilla/5.0 (windows nt 6.1; w" Heuristic match: "get /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=234&r=0&d=4001959 http/1.1accept: text/html, application/xhtml+xml, */*accept-language: zh-cnuser-agent: mozilla/5.0 (windows nt 6.1; w" Heuristic match: "get /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=668&r=0&d=4001959 http/1.1accept: text/html, application/xhtml+xml, */*accept-language: zh-cnuser-agent: mozilla/5.0 (windows nt 6.1; w" Heuristic match: "get /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=722&r=0&d=4001959 http/1.1accept: text/html, application/xhtml+xml, */*accept-language: zh-cnuser-agent: mozilla/5.0 (windows nt 6.1; w" Heuristic match: "get /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=723&r=0&d=4001959 http/1.1accept: text/html, application/xhtml+xml, */*accept-language: zh-cnuser-agent: mozilla/5.0 (windows nt 6.1; w" Heuristic match: "kittip-api.safe.360.cn" Heuristic match: "get /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=51&r=0&d=4001959 http/1.1accept: text/html, application/xhtml+xml, */*accept-language: zh-cnuser-agent: mozilla/5.0 (windows nt 6.1; wo" Heuristic match: "get /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&v=2001318&w=0&b=48&d=4001959&o=70 http/1.1accept: text/html, application/xhtml+xml, */*accept-language: zh-cnuser-agent: mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; rv:11.0) like geckohost: " Heuristic match: "get /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=202&r=0&d=4001959 http/1.1accept: text/html, application/xhtml+xml, */*accept-language: zh-cnuser-agent: mozilla/5.0 (windows nt 6.1; w" Heuristic match: "get /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=210&r=0&d=4001959 http/1.1accept: text/html, application/xhtml+xml, */*accept-language: zh-cnuser-agent: mozilla/5.0 (windows nt 6.1; w" Heuristic match: "get /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=212&r=0&d=4001959 http/1.1accept: text/html, application/xhtml+xml, */*accept-language: zh-cnuser-agent: mozilla/5.0 (windows nt 6.1; w" Heuristic match: "get /hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=229&r=0&d=4001959 http/1.1accept: text/html, application/xhtml+xml, */*accept-language: zh-cnuser-agent: mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; rv:11.0) like geckohost: s.36" Heuristic match: "get /hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=228&r=0&d=4001959 http/1.1accept: text/html, application/xhtml+xml, */*accept-language: zh-cnuser-agent: mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; rv:11.0) like geckohost: s.36" Heuristic match: "get /hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=216&r=0&d=4001959 http/1.1accept: text/html, application/xhtml+xml, */*accept-language: zh-cnuser-agent: mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; rv:11.0) like geckohost: s.36" Heuristic match: "get /hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=230&r=0&d=4001959 http/1.1accept: text/html, application/xhtml+xml, */*accept-language: zh-cnuser-agent: mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; rv:11.0) like geckohost: s.36" Heuristic match: "get /hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=231&r=0&d=4001959 http/1.1accept: text/html, application/xhtml+xml, */*accept-language: zh-cnuser-agent: mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; rv:11.0) like geckohost: s.36" Heuristic match: "get /hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=233&r=0&d=4001959 http/1.1accept: text/html, application/xhtml+xml, */*accept-language: zh-cnuser-agent: mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; rv:11.0) like geckohost: s.36" Heuristic match: "dl.360safe.com" Heuristic match: "dl2.360safe.com" Heuristic match: "grow.safe.360.cn" Heuristic match: ".360.cn" Heuristic match: "ye[ous.360.cn" Pattern match: "https://curl.haxx.se/docs/http-cookies.html" Pattern match: "http://cx.soft.360.cn/soft/getinfo?info=[[100100507,,0" Heuristic match: "x.soft.360.cn" Heuristic match: "ows.gd" Heuristic match: "malgun.tt" Heuristic match: "fdl.360safe.com" Pattern match: "http://p0.qhimg.com/dm/72_72_100/t01709f600470d50b78.png" Heuristic match: "*.soft.360.cn" Heuristic match: "soft.360.cn" Pattern match: "s.360.cn/safe/instcomp.htm?type=onebox_setup&act=3&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e" Pattern match: "cx.soft.360.cn/soft/getinfo?info=[[100100507,,0" Pattern match: "s.360.cn/safe/instcomp.htm?type=o" Pattern match: "360.cn/safe/instcomp.htm?type=onebox_setup&act=3&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&m" Heuristic match: "fdl.360safe.com.wsdvs.com" Heuristic match: "60.cn" Heuristic match: "60safe.com" Heuristic match: "d2aydouiit1aqm.cloudfront.net" Heuristic match: "ttps://login.live.com" Heuristic match: "2aydouiit1aqm.cloudfront.net" Heuristic match: "0.qhimg.com" Heuristic match: "host: s.360.cn" Pattern match: "https://cx.soft.360.cn/soft/getinfo?info=[[100100507,,0" Heuristic match: "host: p0.qhimg.com" Heuristic match: "*.safe.360.cn" Heuristic match: "safe.360.cn" Pattern match: "fdl.360safe.com/gf/360ini.cab" Heuristic match: "himg.com" Pattern match: "p0.qhimg.com/dm/72_72_100/t01709f600470d50b78.png" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1!0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "www.digicert.com1" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Heuristic match: "ui.com" Pattern match: "docs.microsoft.com/typography/about" Pattern match: "0.qhimg.com/dm/72_72_100/t01709f600470d50b78.png" Pattern match: "0.qhimg.com/t11098f6bcd4c2204d670c72a2a.png" Pattern match: "p6.qhimg.com/t11eec6e52f0eb97587874c5833.png" Pattern match: "p8.qhimg.com/t11eec6e52f3beea13a23ce5647.png" Pattern match: "p1.qhimg.com/t11eec6e52fe5dc3f2014d61209.png" Pattern match: "https://p1.qhimg.com/t11eec6e52fe5dc3f2014d61209.png" Pattern match: "https://p3.qhimg.com/t11eec6e52f83f38b2a594c144d.webp" Pattern match: "https://p8.qhimg.com/t11eec6e52f3beea13a23ce5647.png" Pattern match: "https://p7.qhimg.com/t11eec6e52ff40190941c5de7fc.png" Pattern match: "http://p0.qhimg.com/t11098f6bcd4c2204d670c72a2a.png" Pattern match: "https://p6.qhimg.com/t11eec6e52f0eb97587874c5833.png" Pattern match: "https://cdn-download.soft.360.cn/softmanager-installation/20260414/100100507_aa047fdcf4f44158eaf4143674c72795.exe|||https://sfdl.360safe.com/360zip_setup.exe" Pattern match: "com.cn/cn" Pattern match: "www.monotype" Pattern match: "www.agfamonotype.com/html/designer/des_index.html" Pattern match: "type.com/html/designer/des_index.html" Pattern match: "http://www.agfamonotype.com/html/designer/des_index.html" Pattern match: "www.monotype.com/html/type/license.html" Pattern match: "www.itcfonts.com/itc/licensing.html" Pattern match: "www.agfamonotype.com" Pattern match: "http://www.agfamonotype.com" Pattern match: "www.fontbureau.com" Pattern match: "e.com/html/type/license.html" Pattern match: "www.monotype.com/html/type" Pattern match: "otype.com/html/type/license.html" Heuristic match: "qhimg.com" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Pattern match: "http://ocsp.globalsign.com/codesigningrootr450f" Pattern match: "http://secure.globalsign.com/cacert/codesigningrootr45.crt0a" Pattern match: "crl.globalsign.com/codesigningrootr45.crl0u" Pattern match: "https://www.globalsign.com/repository/0" Pattern match: "http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0" Pattern match: "ocsp.globalsign.com/gsgccr45evcodesignca20200u" Pattern match: "crl.globalsign.com/gsgccr45evcodesignca2020.crl0" Pattern match: "ocsp.globalsign.com/gsoffliner45timestampca20250o" Pattern match: "secure.globalsign.com/cacert/gsoffliner45timestampca2025.crt0j" Pattern match: "crl.globalsign.com/gsoffliner45timestampca2025.crl0v" Pattern match: "http://ocsp.globalsign.com/timestamprootr450d" Pattern match: "secure.globalsign.com/cacert/timestamprootr45.crt0" Pattern match: "http://crl.globalsign.com/timestamprootr45.crl0" Pattern match: "http://ocsp2.globalsign.com/rootr60" Pattern match: "http://secure.globalsign.com/cacert/root-r6.crt06" Pattern match: "http://crl.globalsign.com/root-r6.crl0g" Heuristic match: "m .ph" Pattern match: "http://dl.360safe.com/gf/%u.cab" Pattern match: "http://inf.safe.360.cn/sein/think" Pattern match: "http://inf.safe.360.cn/wsin/think" Pattern match: "https://kittip-api.safe.360.cn/main/v1/silent-install/allow" Pattern match: "http://grow.safe.360.cn/conf/item/info" Pattern match: "http://123.com/" Heuristic match: "safeinstallregion.info" Heuristic match: "sdinstall.info" Heuristic match: "ft.360.cn" Pattern match: "e.com/lmem" Pattern match: "https://kittip-api.safe.360.cn/main/v1/silent-install/allow?ipartner=4001959&product=ws&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&only_check_reasons=" Pattern match: "http://s.360.cn/safe/instcomp.htm?type=onebox_setup&act=6&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e" Pattern match: "s.360.cn/safe/instcomp.htm?type=onebox_setup&act=6&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e" Heuristic match: "lb-ir2yodz5mfqcr8a8t6.us-west-1.alb.aliyuncsslbintl.com" Pattern match: "http://grow.safe.360.cn/conf/item/info?m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&mid=aadc6efcafa1272b7bb902eeecd9eb62&position=360ini&q=%51%72%76%71%66%54%43%73%73%31%6d%49%68%41%33%51%6b%53%4b%69%30%31%54%48%77%63%58%54%50%5a%4a%75%74%67%35%53%65%63" Heuristic match: "host: promotion.aiwork.360.cn" Pattern match: "https://promotion.aiwork.360.cn/main/v1/ws/dlink?channel=4001959&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e&mid=aadc6efcafa1272b7bb902eeecd9eb62×tramp=1791706384&version=1.0.0.1151&sign=0b3721c7e4e0a593a9f33b408dcf38d0" Pattern match: "https://cdn-download.soft.360.cn/softmanag" Pattern match: "https://sfdl.360safe.com/360zip_setup.exe" Heuristic match: "$w.mq" Heuristic match: "d$.pf" Heuristic match: "n.aiwork.360.cn" Pattern match: "http://p0.qhimg.com/t01a8caefb81a6b206e.png" Pattern match: "p7.qhimg.com/t11eec6e52ff40190941c5de7fc.png" Pattern match: "http://dl2.360safe.com/partner/installer.exe" Heuristic match: "host: kittip-api.safe.360.cn" Pattern match: "http://dl.360safe.com/gf/360iniverify.cab" Pattern match: "dl.360safe.com/gf/360ini.cab" Pattern match: "dl2.360safe.com/partner/installer.exe" Pattern match: "http://dl.360safe.com/inst_gf_popup.exe" Pattern match: "http://dl.360safe.com/inst_js_popup.exe" Pattern match: "http://dl.360safe.com/inst_gf_popup_ev.exe" Pattern match: "http://dl.360safe.com/inst_js_popup_ev.exe" Pattern match: "http://sfdl.360safe.com/setupbeta_lite.exe" Pattern match: "http://sfdl.360safe.com/inst_gf_popup.exe" Pattern match: "sfdl.360safe.com/inst_js_popup.exe" Pattern match: "sfdl.360safe.com/inst_gf_popup_ev.exe" Pattern match: "http://sfdl.360safe.com/inst_js_popup_ev.exe" Pattern match: "http://dl.360safe.com/gf/def.cab" Pattern match: "http://dl.360safe.com/setup.exe" Pattern match: "http://cd002.www.duba.net/duba/install/2011/ever/kinst_150_1_20160929.exe" Pattern match: "http://dlied6.qq.com/invc/xfspeed/qqpcmgr/download/qqpcdownload1383.exe" Pattern match: "http://dl.360safe.com/360/inst.exe" Pattern match: "http://dl.360safe.com/installer/win/palminputsetup.exe" Pattern match: "https://down.360safe.com/desktoplite/360desktoplite_%d.exe" Pattern match: "https://dl.360safe.com/360zip_npclm_%d.exe" Pattern match: "http://dl.360safe.com/360sd/360sd_gf.exe" Pattern match: "http://dl.360safe.com/360sd/360sd_gf64.exe" Pattern match: "http://dl.360safe.com/360sd/360sd_gfhips.exe" Pattern match: "http://dl.360safe.com/360sd/360sd_gf64hips.exe" Pattern match: "http://dl.360safe.com/sev3/sewstgcs.cab" Pattern match: "http://dl.360safe.com/sev3/sewstg.cab" Pattern match: "http://dl.360safe.com/sev3/sewstgold.cab" Pattern match: "http://dl.360safe.com/sev3/sewstggf.cab" Pattern match: "http://dl.360safe.com/gf/mynewini2.cab" Pattern match: "https://dl.360safe.com/gf/mynewini2.cab"75:T8012,Found URL "http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exesafesave:\users\hapubws\appdata\local\temp\djuuifddomziwbus\zoolsfckudfaj19.exevs_version_infostringfileinfo080404b0filedescriptionfileversion7," - Source: "00000000-00004680.00000000.174800.00400000.00000040.mdmp") Found URL "https://promotion.aiwork.360.cn/main/v1/ws/dlinkhttps://hao.360.com/?y1026https://hao.360.com/?src=lm&ls=%shttps://hao.360.com/?%suipro_shadow_userdata_markwindow_shadow.pnguser32.dll_instsoft_shadow_atl:%pinit" - Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp") Found URL "http://s.360.cn/safe/instcomp.htm?type=onebox_setup&act=%d&status=&detail=&softid=%s&popid=&ver=&enterprise=&pid=%d&mid=%s&m2=%ssafe_logoloading_soft_icon.pngclose.pnglogo.pnghttp://baoku.360.cn/http://http://cx.soft.360.cn/soft/getinfo?info=[[%s," - Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp") Found URL "https://cx.soft.360.cn/soft/getinfo?info=[[%s," - Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp") Found URL "http://baoku.360.cn/soft/show/appid/%smozilla/5.0" - Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp") Found URL "https://promotion.aiwork.360.cn/main/v1/ws/clientup:54360:51360&t=%dhttps://local.info.g9hc4.cn:54360/?callback=uuidjsonpcbaiusm2=%s×trap=%s&version=%s46dnscwfw4qmi1wlrqqfg2vvgsln7695https://bapi.safe.360.cn/client/dcntdll.dll360tray.exeadvapi32.dll360.cn360.comjssetuphttp://s.360.cn/safe/instcomp.htm?type=onebox_setup&act=1&status=%d&detail=%s&softid=%s&popid=&ver=%s&enterprise=%d&pid=%d&mid=%s&m2=%snosignsign/softid=%s" - Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp") Found URL "http://down.360safe.com/setup.exepath360ver.dllopen360ini.dllbeaconhttp/1.1head360ini.cabhttp://sfdl.360safe.com/gf/360ini.cabhttp://dl.360safe.com/gf/360ini.cab" - Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp") Found URL "https://curl.haxx.se/docs/http-cookies.html" - Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp") Found URL "ftp://%s:%s@%scontent-range:" - Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp") Found URL "ftp://host:" - Source: "00000000-00005696.00000000.158764.00489000.00000002.mdmp") Found URL "http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exexxxx:\setup360__100100507_4001959_csmnfx8p.exe23f0ef3958accbbb543a1067d28c805f479293382b7e23f0ef3958accbbb543a1067d28c805f479293382b7e.?avinvalid_argument@std@@.?avtype_info@@.?avbad_typeid@std@@.?av__non_rtti_object@std@@.?avbad_exception@std@@" - Source: "00000000-00005696.00000000.158764.004A3000.00000004.mdmp") Found URL "http://cx.soft.360.cn/soft/getinfo?info=[[100100507," - Source: "00000000-00005696.00000000.158764.00A20000.00000004.mdmp") Found URL "http://p0.qhimg.com/dm/72_72_100/t01709f600470d50b78.png:\windows\system32\netapi32.dllnetapi32.dll*.soft.360.cnsoft.360.cncx.soft.360.cn:\windows\system32\cabinet.dlls\mitextra.ttfoftware\microsoft\enterprisecertificates\trustedpeople\physicalstorestextshaping.dll:\users\hapubws\appdata\local\microsoft\windows\history\history.ie5:\windows\system32\msimg32.dll:\windows\system32\userenv.dllpinrules_autoupdate_1c:\users\hapubws\appdata\local\microsoft\windows\historyhistory.ie5desktop-8ld9t6n\hapubws%systemroot%\system32\napinsp.dll,-1000\inwsoftware\classes\protocols\filter\text/htmlsoftware\classes\protocols\filter\text/htmlsoftware\policies\microsoft\internet" - Source: "00000000-00005696.00000000.158764.00A20000.00000004.mdmp") Found URL "http://sfdl.360safe.com/gf/360ini.cabhttp://sfdl.360safe.com/gf/360ini.cabc:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\gpcscce5\360ini[1].cabn/x-compressedfdl.360safe.com.wsdvs.comsha1hkdf360.usershapubwsappdatalocaltemp??\c:\program" - Source: "00000000-00005696.00000000.158764.00A20000.00000004.mdmp") Found URL "https://cx.soft.360.cn/soft/getinfo?info=[[100100507," - Source: "00000000-00005696.00000000.158764.00A20000.00000004.mdmp") Found URL "http://sfdl.360safe.com/gf/360ini.cabhttp://sfdl.360safe.com/gf/360ini.cabhttp://sfdl.360safe.com/gf/360ini.cabassmlmemhttp://sfdl.360safe.com/gf/360ini.cabdigest" - Source: "00000000-00005696.00000000.158764.00A20000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005696.00000000.158764.00AD6000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00005696.00000000.158764.00AD6000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005696.00000000.158764.00AD6000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00005696.00000000.158764.00AD6000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005696.00000000.158764.00AD6000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00005696.00000000.158764.00AD6000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lasycasyccv" - Source: "00000000-00005696.00000000.158764.00AD6000.00000004.mdmp") Found URL "http://sfdl.360safe.com/gf/360ini.cab170531232859z180601232859z01.3.132.0.35@eckp" - Source: "00000000-00005696.00000000.158764.00AD6000.00000004.mdmp") Found URL "http://p0.qhimg.com/dm/72_72_100/t01709f600470d50b78.png-downlo" - Source: "00000000-00005696.00000000.158764.02DD0000.00000004.mdmp") Found URL "http://p0.qhimg.com/dm/72_72_100/t01709f600470d50b78.pngdcf4f440.qhimg.com/dm/72_72_100/t01709f600470d50b78.pnglanguagecodeguagecate_mult_languagebnameerrmsgerrnodatanamedescnamebriefcorpbrief100100507" - Source: "00000000-00005696.00000000.158764.02DD0000.00000004.mdmp") Found URL "http://p0.qhimg.com/dm/72_72_100/t01709f600470d50b78.pnghttp://p0.qhimg.com/dm/72_72_100/t01709f600470d50b78.pnghttp://p0.qhimg.com/dm/72_72_100/t01709f600470d50b78.pnghttp://p0.qhimg.com/dm/72_72_100/t01709f600470d50b78.pnghttp://p0.qhimg.com/dm/72_72_100/t01709f600470d50b78.pnghttp://p0.qhimg.com/dm/72_72_100/t01709f600470d50b78.pnghttp://p0.qhimg.com/dm/72_72_100/t01709f600470d50b78.png675165161b93d35ae874d59erelated_search_terms_output675165161b93d35ae874d59f675198c59c18210cf6408b1f675165161b93d35ae874d59e675165161b93d35ae874d59fscript_urlsoft_group_idmulti_downcleanse_statussnap_urlupdate_rategame_supportedis_review_whiteupdate_snapgraphics_cardsoft_scoresoft_tag_listsimple_briefsoft_sizesoft_search_extsoft_iframe_urlimportantedition_shashupgrade_flaggift_packageedition_idess_subcatesoft_vote_infomobile_gamesearch_showvideo_url4.0.0.1680pc_recom_configsnapshotlanguagebackground_urledition_infogift_pack_showmulti_urlsbaoku_subcatecache_flagdefault_editionhttps://p1.qhimg.com/t11eec6e52fe5dc3f2014d61209.pnghttps://p3.qhimg.com/t11eec6e52f83f38b2a594c144d.webphttps://p8.qhimg.com/t11eec6e52f3beea13a23ce5647.pnghttps://p7.qhimg.com/t11eec6e52ff40190941c5de7fc.pnghttp://p0.qhimg.com/t11098f6bcd4c2204d670c72a2a.pnghttps://p6.qhimg.com/t11eec6e52f0eb97587874c5833.pnggv" - Source: "00000000-00005696.00000000.158764.03AB0000.00000004.mdmp") Found URL "https://cdn-download.soft.360.cn/softmanager-installation/20260414/100100507_aa047fdcf4f44158eaf4143674c72795.exe" - Source: "00000000-00005696.00000000.158764.03ABC000.00000004.mdmp") Found URL "https://sfdl.360safe.com/360zip_setup.exe4022b5a95d519f5b81aefb9fd20d7a44p2=deada85e79dc97a5149cab7bb1f9edc3a6ac9b01" - Source: "00000000-00005696.00000000.158764.03ABC000.00000004.mdmp") Found URL "https://sfdl.360safe.com/360zip_setup.exe4022b5a95d519f5b81aefb9fd20d7a44gv" - Source: "00000000-00005696.00000000.158764.03ABC000.00000004.mdmp") Found URL "http://www.agfamonotype.com/html/designer/des_index.htmlsk-ska-ess-cza-dke-des-cza-dke-del-grn-usa-ess-cza-dk" - Source: "00000000-00005696.00000000.158764.03F40000.00000004.mdmp") Found URL "http://www.agfamonotype.comc:\windows\fonts\tahoma.ttfbodoni" - Source: "00000000-00005696.00000000.158764.03F40000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005696.00000000.158764.05700000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005696.00000000.158764.05700000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005696.00000000.158764.05700000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005696.00000000.158764.05700000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005696.00000000.158764.05700000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005696.00000000.158764.05700000.00000004.mdmp") Found URL "http://ocsp.globalsign.com/codesigningrootr450f:http://secure.globalsign.com/cacert/codesigningrootr45.crt0a:08060http://crl.globalsign.com/codesigningrootr45.crl0un0l0a0402&https://www.globalsign.com/repository/0jh4%bwf*=" - Source: "00000000-00005696.00000000.158764.05700000.00000004.mdmp") Found URL "http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?3http://ocsp.globalsign.com/gsgccr45evcodesignca20200un0l0a0402&https://www.globalsign.com/repository/0@0>0<6http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0mvxo!t6/@pu%8lq3" - Source: "00000000-00005696.00000000.158764.05700000.00000004.mdmp") Found URL "http://ocsp.globalsign.com/gsoffliner45timestampca20250ochttp://secure.globalsign.com/cacert/gsoffliner45timestampca2025.crt0jc0a0?9http://crl.globalsign.com/gsoffliner45timestampca2025.crl0vo0m00402&https://www.globalsign.com/repository/0[:*9ome[d5?58frwwx" - Source: "00000000-00005696.00000000.158764.05700000.00000004.mdmp") Found URL "http://ocsp.globalsign.com/timestamprootr450d8http://secure.globalsign.com/cacert/timestamprootr45.crt0?80604.http://crl.globalsign.com/timestamprootr45.crl0bjsxdhhx(" - Source: "00000000-00005696.00000000.158764.05700000.00000004.mdmp") Found URL "http://ocsp2.globalsign.com/rootr60;/http://secure.globalsign.com/cacert/root-r6.crt06/0-0+%http://crl.globalsign.com/root-r6.crl0g@0>0<0402&https://www.globalsign.com/repository/06wmnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005696.00000001.160683.00AB3000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00005696.00000001.160683.00AB3000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lasycasyccv" - Source: "00000000-00005696.00000001.160683.00AB3000.00000004.mdmp") Found URL "http://p0.qhimg.com/dm/72_72_100/t01709f600470d50b78.pnghttp://p0.qhimg.com/dm/72_72_100/t01709f600470d50b78.pnghttp://p0.qhimg.com/dm/72_72_100/t01709f600470d50b78.pnghttp://p0.qhimg.com/dm/72_72_100/t01709f600470d50b78.png" - Source: "00000000-00005696.00000001.160683.03AB0000.00000004.mdmp") Found URL "http://p0.qhimg.com/dm/72_72_100/t01709f600470d50b78.pnghttp://p0.qhimg.com/dm/72_72_100/t01709f600470d50b78.pnghttp://p0.qhimg.com/dm/72_72_100/t01709f600470d50b78.png47.88.48.12047.88.48.120192.168.0.2timestampsoft_group_idmulti_downdh_channeldh_channelupdate_ratetrace_id_whitetrace_iddh_channelsoft_scoresoft_tag_listsimple_briefsoft_search_extsoft_iframe_urlimportantedition_shashupgrade_flaggift_package/x0xess_subcatesoft_vote_infomobile_gamevideo_url4.0.0.1680pc_recom_configtimestamplanguagebackground_urledition_infogift_pack_showmulti_urlsbaoku_subcatecache_flagdefault_editionhttps://p1.qhimg.com/t11eec6e52fe5dc3f2014d61209.pnghttps://p3.qhimg.com/t11eec6e52f83f38b2a594c144d.webppromotion.aiwork.360.cn:443https://p8.qhimg.com/t11eec6e52f3beea13a23ce5647.png443promotion.aiwork.360.cnfc.pnghttp://p0.qhimg.com/t11098f6bcd4c2204d670c72a2a.pnghttps://p6.qhimg.com/t11eec6e52f0eb97587874c5833.png:0," - Source: "00000000-00005696.00000001.160683.03AB0000.00000004.mdmp") Found URL "https://promotion.aiwork.360.cn/main/v1/ws/dlink?channel=4001959&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e&mid=aadc6efcafa1272b7bb902eeecd9eb62×tramp=1791706384&version=1.0.0.1151&sign=0b3721c7e4e0a593a9f33b408dcf38d0stayp2=deada85e79dc97a5149cab7bb1f9edc3a6ac9b01" - Source: "00000000-00005696.00000001.160683.03AB0000.00000004.mdmp") Found URL "https://cdn-download.soft.360.cn/softmanag20260414/100100507_aa047fdcf4f44158eaf4143674c72795.exe" - Source: "00000000-00005696.00000001.160683.03AB0000.00000004.mdmp") Found URL "https://sfdl.360safe.com/360zip_setup.exe4022b5a95d519f5b81aefb9fd20d7a44n/v1/ws/dlink?channel=4001959&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e&mid=aadc6efcafa1272b7bb902eeecd9eb62×tramp=1791706384&version=1.0.0.1151&sign=0b3721c7e4e0a593a9f33b408dcf38d0" - Source: "00000000-00005696.00000001.160683.03AB0000.00000004.mdmp") Found URL "https://hao.360.com/?y1026etupdigetdeviceregistrypropertywntermediate" - Source: "00000000-00005696.00000001.160683.05700000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005696.00000001.160683.05700000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005696.00000001.160683.05700000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005696.00000001.160683.05700000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005696.00000001.160683.05700000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005696.00000001.160683.05700000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005696.00000001.160683.05700000.00000004.mdmp") Found URL "http://ocsp.globalsign.com/codesigningrootr450f:http://secure.globalsign.com/cacert/codesigningrootr45.crt0a:08060http://crl.globalsign.com/codesigningrootr45.crl0un0l0a0402&https://www.globalsign.com/repository/0jh4%bwf*=" - Source: "00000000-00005696.00000001.160683.05700000.00000004.mdmp") Found URL "http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?3http://ocsp.globalsign.com/gsgccr45evcodesignca20200un0l0a0402&https://www.globalsign.com/repository/0@0>0<6http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0mvxo!t6/@pu%8lq3" - Source: "00000000-00005696.00000001.160683.05700000.00000004.mdmp") Found URL "http://ocsp.globalsign.com/gsoffliner45timestampca20250ochttp://secure.globalsign.com/cacert/gsoffliner45timestampca2025.crt0jc0a0?9http://crl.globalsign.com/gsoffliner45timestampca2025.crl0vo0m00402&https://www.globalsign.com/repository/0[:*9ome[d5?58frwwx" - Source: "00000000-00005696.00000001.160683.05700000.00000004.mdmp") Found URL "http://ocsp.globalsign.com/timestamprootr450d8http://secure.globalsign.com/cacert/timestamprootr45.crt0?80604.http://crl.globalsign.com/timestamprootr45.crl0bjsxdhhx(" - Source: "00000000-00005696.00000001.160683.05700000.00000004.mdmp") Found URL "http://ocsp2.globalsign.com/rootr60;/http://secure.globalsign.com/cacert/root-r6.crt06/0-0+%http://crl.globalsign.com/root-r6.crl0g@0>0<0402&https://www.globalsign.com/repository/06wmnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005696.00000002.162605.00AB3000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00005696.00000002.162605.00AB3000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lasycasyccv" - Source: "00000000-00005696.00000002.162605.00AB3000.00000004.mdmp") Found URL "http://p0.qhimg.com/t01a8caefb81a6b206e.pngn/v1/ws/dlink?channel=4001959&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e&mid=aadc6efcafa1272b7bb902eeecd9eb62×tramp=1791706384&version=1.0.0.1151&sign=0b3721c7e4e0a593a9f33b408dcf38d0" - Source: "00000000-00005696.00000002.162605.02DDB000.00000004.mdmp") Found URL "http://p0.qhimg.com/t11098f6bcd4c2204d670c72a2a.pngp1.qhimg.com/t11eec6e52fe5dc3f2014d61209.pnghttps://p8.qhimg.com/t11eec6e52f3beea13a23ce5647.pngp7.qhimg.com/t11eec6e52ff40190941c5de7fc.png0.qhimg.com/dm/72_72_100/t01709f600470d50b78.png" - Source: "00000000-00005696.00000002.162605.02DDB000.00000004.mdmp") Found URL "https://hao.360.com/?y1026tsregistersessionnotificationexntermediate" - Source: "00000000-00005696.00000002.162605.05700000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005696.00000002.162605.05700000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005696.00000002.162605.05700000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005696.00000002.162605.05700000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005696.00000002.162605.05700000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005696.00000002.162605.05700000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005696.00000002.162605.05700000.00000004.mdmp") Found URL "http://ocsp.globalsign.com/codesigningrootr450f:http://secure.globalsign.com/cacert/codesigningrootr45.crt0a:08060http://crl.globalsign.com/codesigningrootr45.crl0un0l0a0402&https://www.globalsign.com/repository/0jh4%bwf*=" - Source: "00000000-00005696.00000002.162605.05700000.00000004.mdmp") Found URL "http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?3http://ocsp.globalsign.com/gsgccr45evcodesignca20200un0l0a0402&https://www.globalsign.com/repository/0@0>0<6http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0mvxo!t6/@pu%8lq3" - Source: "00000000-00005696.00000002.162605.05700000.00000004.mdmp") Found URL "http://ocsp.globalsign.com/gsoffliner45timestampca20250ochttp://secure.globalsign.com/cacert/gsoffliner45timestampca2025.crt0jc0a0?9http://crl.globalsign.com/gsoffliner45timestampca2025.crl0vo0m00402&https://www.globalsign.com/repository/0[:*9ome[d5?58frwwx" - Source: "00000000-00005696.00000002.162605.05700000.00000004.mdmp") Found URL "http://ocsp.globalsign.com/timestamprootr450d8http://secure.globalsign.com/cacert/timestamprootr45.crt0?80604.http://crl.globalsign.com/timestamprootr45.crl0bjsxdhhx(" - Source: "00000000-00005696.00000002.162605.05700000.00000004.mdmp") Found URL "http://ocsp2.globalsign.com/rootr60;/http://secure.globalsign.com/cacert/root-r6.crt06/0-0+%http://crl.globalsign.com/root-r6.crl0g@0>0<0402&https://www.globalsign.com/repository/06w Microsoft Corporation\"\n \"360ini.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"zoolsfCkUdFaJ19.exe\" was detected as \"PeCompact 2.xx (Slim Loader) --> BitSum Technologies\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"setup360__100100507_4001959_csMNFx8p.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"informative","category":"Unusual Characteristics","name":"References registry location(s) potentially used by malware","description":"Observed string: \"Software\\Classes\\ms-settings\\shell\\open\\command\" (Indicator: \"ms-settings\\shell\\open\") in Source: 00000000-00005696.00000000.158764.731FA000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-428","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"360ini.dll\" has section name .rsrc with entropy \"7.467356962536349\"\n \"zoolsfCkUdFaJ19.exe\" has section name .text with entropy \"7.959319183940164\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/23 Antivirus vendors marked sample as malicious (21% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"suspicious","category":"General","name":"Able to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.dll at 14307-2858-004529B0\n DeviceIoControl@KERNEL32.dll at 14307-2902-00450DB0\n DeviceIoControl@KERNEL32.dll at 14307-2905-00450A70\n DeviceIoControl@KERNEL32.dll at 14307-2907-004506B0\n DeviceIoControl@KERNEL32.dll at 14307-3229-0040A770\n DeviceIoControl@KERNEL32.dll at 14307-3231-0040A610\n DeviceIoControl@KERNEL32.dll at 14307-3711-004025D0\n DeviceIoControl@KERNEL32.dll at 14307-4130-004295E0\n DeviceIoControl@KERNEL32.dll at 14307-4182-00425D50\n DeviceIoControl@KERNEL32.dll at 14307-4199-0042BE60\n DeviceIoControl@KERNEL32.dll at 14307-4997-00407C40\n DeviceIoControl@KERNEL32.dll at 14307-5108-00402550","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1547.006","relevance":5,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"suspicious","category":"General","name":"Contains ability to execute program","description":"ShellExecuteW@SHELL32.dll at 14307-3295-004446E0\n ShellExecuteW@SHELL32.dll at 14307-3297-00402530\n ShellExecuteW@SHELL32.dll at 14307-3631-00444DA0\n ShellExecuteW@SHELL32.dll at 14307-3742-0043B6B0\n ShellExecuteExW@SHELL32.dll at 14307-5091-00402E10\n ShellExecuteW@SHELL32.dll at 14307-5092-00402DE0\n ShellExecuteW@SHELL32.dll at 14307-5104-00402B60\n ShellExecuteExW@SHELL32.dll at 14307-5109-00402540","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":7,"id":"stream-106","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.dll at 14307-3128-004022D0\n FindResourceW@KERNEL32.dll at 14307-3323-00443700\n FindResourceW@KERNEL32.dll at 14307-3329-00424DC0\n FindResourceW@KERNEL32.dll at 14307-3333-004434B0\n FindResourceW@KERNEL32.dll at 14307-3882-00436FA0\n FindResourceW@KERNEL32.dll at 14307-4117-004274D0\n FindResourceExW@KERNEL32.dll at 14307-5119-00402030","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"$92","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"360ini.dll\" has type \"PE32 executable for MS Windows 5.00 (DLL) Intel i386 6 sections\"- Location: [%TEMP%\\cShRjRnAlKqUrKuD\\360ini.dll]- [targetUID: 00000000-00005696]\n \"zoolsfCkUdFaJ19.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 PECompact2 compressed 2 sections\"- [targetUID: N/A]\n \"tAgXmEoSeJkBaOaV64.tmp\" has type \"PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections\"- Location: [%TEMP%\\tAgXmEoSeJkBaOaV64.tmp]- [targetUID: 00000000-00005696]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"setup360__100100507_4001959_csMNFx8p.exe\" wrote 32768 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\cShRjRnAlKqUrKuD\\360ini.dll\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...\n \"setup360__100100507_4001959_csMNFx8p.exe\" wrote 4096 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tAgXmEoSeJkBaOaV64.tmp\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 101.198.193.210 on port 443 is sent without HTTP header\n TCP traffic to 106.63.103.14 on port 443 is sent without HTTP header\n TCP traffic to 171.13.14.66 on port 80 is sent without HTTP header\n TCP traffic to 157.185.163.159 on port 80 is sent without HTTP header\n TCP traffic to 52.84.20.18 on port 80 is sent without HTTP header\n TCP traffic to 101.198.3.25 on port 80 is sent without HTTP header\n TCP traffic to 47.88.48.120 on port 443 is sent without HTTP header\n TCP traffic to 101.198.3.60 on port 443 is sent without HTTP header\n TCP traffic to 104.192.108.20 on port 80 is sent without HTTP header\n TCP traffic to 104.192.108.21 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"setup360__100100507_4001959_csMNFx8p.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in File: \"setup360_100100507_4001959_csMNFx8p.exe\")\n Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00005696.00000000.158764.00489000.00000002.mdmp\")\n Found string \"em32\\wbem\\wmiprvse.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00005696.00000000.158764.00A20000.00000004.mdmp, 00000000-00005696.00000001.160683.00A20000.00000004.mdmp, 00000000-00005696.00000002.162605.00A20000.00000004.mdmp\")\n Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00005696.00000000.158764.02980000.00000004.mdmp, 00000000-00005696.00000001.160683.02980000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"setup360__100100507_4001959_csMNFx8p.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\6LDIEKEG\\instcomp[1].htm\" with delete access\n \"setup360__100100507_4001959_csMNFx8p.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\360ini.cab\" with delete access\n \"setup360__100100507_4001959_csMNFx8p.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\3SXYTHIH\\instcomp[1].htm\" with delete access\n \"setup360__100100507_4001959_csMNFx8p.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\{56E18856-2C41-4092-BB21-FA37C34F71C4}\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"setup360__100100507_4001959_csMNFx8p.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"360ini.dll\" claimed CRC 1041257 while the actual is CRC 4576633\n \"zoolsfCkUdFaJ19.exe\" claimed CRC 4576633 while the actual is CRC 66941\n \"tAgXmEoSeJkBaOaV64.tmp\" claimed CRC 66941 while the actual is CRC 222111","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$93","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to create a thread in another process","description":"\"setup360__100100507_4001959_csMNFx8p.exe\" called \"CreateRemoteThread\" with parameters {\"hProcess\": \"4294967295\"\n \"lpThreadAttributes\": \"0\"\n \"dwStackSize\": \"0\"\n \"lpStartAddress\": \"1930806432\"\n \"lpParameter\": \"57077600\"\n \"dwCreationFlags\": \"0\"\n \"lpThreadId\": \"0\"}","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-106","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Reads Antivirus engine related registry keys","description":"\"setup360__100100507_4001959_csMNFx8p.exe\" (Path: \"HKLM\\SOFTWARE\\RISING\\RAV\")\n \"setup360__100100507_4001959_csMNFx8p.exe\" (Path: \"HKLM\\SOFTWARE\\JIANGMIN\")\n \"setup360__100100507_4001959_csMNFx8p.exe\" (Path: \"HKLM\\SOFTWARE\\ESET\\ESET SECURITY\\CURRENTVERSION\\INFO\")\n \"setup360__100100507_4001959_csMNFx8p.exe\" (Path: \"HKLM\\SOFTWARE\\AVIRA\\LAUNCHER\")\n \"setup360__100100507_4001959_csMNFx8p.exe\" (Path: \"HKLM\\SOFTWARE\\BITDEFENDER\")\n \"setup360__100100507_4001959_csMNFx8p.exe\" (Path: \"HKLM\\SOFTWARE\\AHNLAB\\V3IS80\")\n \"setup360__100100507_4001959_csMNFx8p.exe\" (Path: \"HKLM\\SOFTWARE\\AVG\\FRAMEWORK\\COMMON\")\n \"setup360__100100507_4001959_csMNFx8p.exe\" (Path: \"HKLM\\SOFTWARE\\MCAFEE\\MSC\")\n \"setup360__100100507_4001959_csMNFx8p.exe\" (Path: \"HKLM\\SOFTWARE\\RISING\\RSE\")\n \"setup360__100100507_4001959_csMNFx8p.exe\" (Path: \"HKCU\\SOFTWARE\\360INICONFIG_ELFSNOW\")","origin":"Registry Access","mitre_attack_id":"T1518.001","relevance":8,"id":"registry-32","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/grayware_confidence_90% (D)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - XOR-encoded PE executable in .rsrc section","description":"YARA signature for a XOR-encoded PE executable within the resource section matched on file \"360ini.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":9,"id":"yara-60","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"\"setup360__100100507_4001959_csMNFx8p.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\IDENTITYCRL\")\n \"setup360__100100507_4001959_csMNFx8p.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\IDENTITYCRL\"; Key: \"LOGINURL\")","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %TEMP%\\DYMVTJFDYVODAWGC\\360INI.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"setupWPSOffice_104693057_4026520_TvZYRN97.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\cEeIuZpQfZeIeKqK\\zoolsnNfDlHkB11.exe\" FF0cXRxdKV0cXRhdbV0cXTldDF0fXW1dHF0aXQhdHF04XRxdHF1kXRx\" - (UID: 00000000-00001160)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"setupWPSOffice_104693057_4026520_TvZYRN97.exe\" failed to load missing module \"phoneinfo.dll\" - [base:0; Status:c0000135]\n \"setupWPSOffice_104693057_4026520_TvZYRN97.exe\" failed to load missing module \"AdvAPI\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysNative\\ntoskrnl.exe\" [Source: 00000000-00001160-00000C2B-3210015319]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"setupWPSOffice_104693057_4026520_TvZYRN97.exe\" queries basic process information of the \"C:\\setupWPSOffice_104693057_4026520_TvZYRN97.exe\" (UID: 1160)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"setupWPSOffice_104693057_4026520_TvZYRN97.exe\" called \"NtQueueApcThread\" (UID: 00000000-00001160)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"4wNZy5w~9wWy\"\n \"m{=s]M=]\"\n \"m{=s]M=]\"\n \"qk\\]|k~}t\"\n \"4wNZy5w~9wWy\"\n \"{_xuzV{y9\"\n \"m{=s]M=]\"\n \"4wNZy5w~9wWy\"\n \"{k|{w}i8\"\n \"4wNZy5w~9wWy\"\n \"wfsgyq\\<:\"","origin":"Network Traffic","mitre_attack_id":"T1132.001","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PE executable embedded in .rsrc section","description":"YARA signature for embedded PE executable in .rsrc section matched on file \"_D0CBD4D5-B259-4d63-AC1A-D0DA099769E6_\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":5,"id":"yara-26","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"_D0CBD4D5-B259-4d63-AC1A-D0DA099769E6_\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - MD5 algorithm","description":"YARA signature for MD5 algorithm matched on file \"360ini.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-112","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM\" matched file \"360ini.dll\" as \"Detects executables embedding command execution via IExecuteCommand COM object\"\n YARA signature \"INDICATOR_EXE_Packed_VMProtect\" matched file \"_D0CBD4D5-B259-4d63-AC1A-D0DA099769E6_\" as \"Detects executables packed with VMProtect.\"","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to retrieve browser cookies using SQL","description":"$94","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-692","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser cookies (file access)","description":"\"setupWPSOffice_104693057_4026520_TvZYRN97.exe\" attempting to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"setupWPSOffice_104693057_4026520_TvZYRN97.exe\" attempting to open a file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\"","origin":"API Call","mitre_attack_id":"T1539","relevance":10,"id":"api-301","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"setupWPSOffice_104693057_4026520_TvZYRN97.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"4c010884\"\n \"cx\": \"375\"\n \"cy\": \"114\"}\n \"setupWPSOffice_104693057_4026520_TvZYRN97.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"d010830\"\n \"cx\": \"375\"\n \"cy\": \"114\"}\n \"setupWPSOffice_104693057_4026520_TvZYRN97.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"601094a\"\n \"cx\": \"375\"\n \"cy\": \"114\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":5,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"$95","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.dll at 43330-3273-00443DF0\n Process32NextW@KERNEL32.dll at 43330-3274-0044EFDA\n CreateToolhelp32Snapshot@KERNEL32.dll at 43330-3275-0044EFE0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@KERNEL32.dll at 43330-3436-00440D80\n GetModuleFileNameW@KERNEL32.dll at 43330-3623-00440840\n GetModuleFileNameW@KERNEL32.dll at 43330-3909-004394C0\n GetModuleFileNameW@KERNEL32.dll at 43330-3913-004365E0\n GetModuleFileNameW@KERNEL32.dll at 43330-4026-0042D350","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\".skype.com1&0\" (Indicator: \"skype.com\")\n \"community-stage.skype.com1\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"setupWPSOffice_104693057_4026520_TvZYRN97.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\instcomp[1].htm\" for deletion\n \"setupWPSOffice_104693057_4026520_TvZYRN97.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\360ini.cab\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"suspicious","category":"System Destruction","name":"Tries to obtain a handle with write access to the physical drive","description":"\"setupWPSOffice_104693057_4026520_TvZYRN97.exe\" attempted to obtain write access to \"PhysicalDrive0\"","origin":"API Call","mitre_attack_id":"T1542.003","relevance":10,"id":"api-58","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"setupWPSOffice_104693057_4026520_TvZYRN97.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\cEeIuZpQfZeIeKqK\\zoolsnNfDlHkB11.exe\" FF0cXRxdKV0cXRhdbV0cXTldDF0fXW1dHF0aXQhdHF04XRxdHF1kXRx\" - (UID: 00000000-00001160)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"setupWPSOffice_104693057_4026520_TvZYRN97.exe\" set thread context in remote process \"%TEMP%\\cEeIuZpQfZeIeKqK\\zoolsnNfDlHkB11.exe\" (PID: 1fc4)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$96","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"malicious","category":"Network Related","name":"GETs executable from a web server (HTTPS)","description":"GET /partner/installer.exe HTTP/1.1\nRANGE: bytes=0-412295\nUser-Agent: Beacon\nHost: dl2.360safe.com\nCache-Control: no-cache\n","origin":"Network Traffic","mitre_attack_id":"T1105","relevance":5,"id":"network-74","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"level":"malicious","category":"System Destruction","name":"Interacts with the primary disk partition (DR0)","description":"\"setupWPSOffice_104693057_4026520_TvZYRN97.exe\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x2d1400\n \"setupWPSOffice_104693057_4026520_TvZYRN97.exe\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x74080\n \"setupWPSOffice_104693057_4026520_TvZYRN97.exe\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x7c088","origin":"API Call","mitre_attack_id":"T1542.003","relevance":5,"id":"api-59","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to query network adapter information"}],"sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"Evasive","details_count":7,"details":[{"detail":"Possibly tries to evade analysis by sleeping multiple times"},{"detail":"Reads Antivirus engine related registry keys"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 10 domains and 10 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Interacts with the primary disk partition (DR0)"}],"sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"GETs/downloads executable files from web server"}],"sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]}],"intel_graph":{"map":{"Domain:213714e2520653597a70a79b89dcd88663260d1ab79c67ccaf9b3eb01df91eda":{"type":"Domain","value":"s.360.cn","verdict":{"verdict":"unknown"}},"Domain:46b939a8db8b4093f8401233e25a7a09ba059c5c205a73b69fbb4f850757ef10":{"type":"Domain","value":"sfdl.360safe.com","verdict":{"verdict":"unknown"}},"Domain:986b62f7a1c3bddd067ef8130d44370355d4e88e745b3916bbe11a23e32b8d1d":{"type":"Domain","value":"local.info.g9hc4.cn","verdict":{"verdict":"unknown"}},"Domain:c9856a23b9abac2c544250ee5f9b5cbee9d53665d497f8336c22f615e78a97ab":{"type":"Domain","value":"bapi.safe.360.cn","verdict":{"verdict":"clean","verdict_source":"domain reputation data","reasons":["reported clean domain"]}},"Domain:cx.soft.360.cn":{"type":"Domain","value":"cx.soft.360.cn"},"Domain:dl.360safe.com":{"type":"Domain","value":"dl.360safe.com"},"Domain:dl2.360safe.com":{"type":"Domain","value":"dl2.360safe.com"},"Domain:grow.safe.360.cn":{"type":"Domain","value":"grow.safe.360.cn"},"Domain:kittip-api.safe.360.cn":{"type":"Domain","value":"kittip-api.safe.360.cn"},"Domain:p0.qhimg.com":{"type":"Domain","value":"p0.qhimg.com"},"Domain:p6.qhimg.com":{"type":"Domain","value":"p6.qhimg.com"},"Domain:promotion.aiwork.360.cn":{"type":"Domain","value":"promotion.aiwork.360.cn"},"File:03d815465762d2d74d2ba85e0df49c744920b6213d1cdb0b06aec346e74e2f18":{"type":"File","value":"03d815465762d2d74d2ba85e0df49c744920b6213d1cdb0b06aec346e74e2f18"},"File:085a1aaed96d23b5ff16e09ffd8670209cddfb325d8feed9e7b6ee831af64af1":{"type":"File","value":"085a1aaed96d23b5ff16e09ffd8670209cddfb325d8feed9e7b6ee831af64af1"},"File:10562de867351c45f0e1b77e3706c9a303c2c30dbf3b4b6e9fb7f8e6c63d7885":{"type":"File","value":"10562de867351c45f0e1b77e3706c9a303c2c30dbf3b4b6e9fb7f8e6c63d7885"},"File:128de212bb214e85329581b169052cb8c963a094668a7fd2136b4d7c66e36ee0":{"type":"File","value":"128de212bb214e85329581b169052cb8c963a094668a7fd2136b4d7c66e36ee0"},"File:130ae2654049559f882d510aa04d60dd2d76e1ba09c6941c7b15f11c75ad7437":{"type":"File","value":"130ae2654049559f882d510aa04d60dd2d76e1ba09c6941c7b15f11c75ad7437"},"File:1a94c8093239d22ad2a1211b6e8068ca52bc4f3630c67a1548d268174bfa5fe7":{"type":"File","value":"1a94c8093239d22ad2a1211b6e8068ca52bc4f3630c67a1548d268174bfa5fe7"},"File:26eaf0db2168de7a4a3e69cf941c421a5b417e575927ef7ad9064caec197447a":{"type":"File","value":"26eaf0db2168de7a4a3e69cf941c421a5b417e575927ef7ad9064caec197447a"},"File:37fb9cfe3f0efdb59fd9ed4885cecbae676faad9d479491b9de8da8b7293e0bd":{"type":"File","value":"37fb9cfe3f0efdb59fd9ed4885cecbae676faad9d479491b9de8da8b7293e0bd"},"File:3c1b6487f54212c0488c4a4b4708f5653af43a737641ffbf4bab8b84fa2e3938":{"type":"File","value":"3c1b6487f54212c0488c4a4b4708f5653af43a737641ffbf4bab8b84fa2e3938"},"File:49e89cee18c70c7cee69518819ab778ef9a061fa81b0b30c3ecaaa008152cf16":{"type":"File","value":"49e89cee18c70c7cee69518819ab778ef9a061fa81b0b30c3ecaaa008152cf16"},"File:4d5aa3c0aeebc3657440653df09fb4f603e813c391d6ee7739e0b8f73371b55f":{"type":"File","value":"4d5aa3c0aeebc3657440653df09fb4f603e813c391d6ee7739e0b8f73371b55f"},"File:5467b4915e771d2b3174dd42cef5bcffe6557dccbe4e8620ba261aa719f25cea":{"type":"File","value":"5467b4915e771d2b3174dd42cef5bcffe6557dccbe4e8620ba261aa719f25cea"},"File:57a9f60b95b59d06ec1c5218846c8a3a76a56750aaa81f7d63a36a8a9f794505":{"type":"File","value":"57a9f60b95b59d06ec1c5218846c8a3a76a56750aaa81f7d63a36a8a9f794505"},"File:58fbe6a236726ab61e940b5070a68c83555bc97db4d2c8831af175dd5d1e94b6":{"type":"File","value":"58fbe6a236726ab61e940b5070a68c83555bc97db4d2c8831af175dd5d1e94b6"},"File:6ee6b6d645bfec9cbb11556cd183ffb7dfc24cad249df6680841f1ffae256e34":{"type":"File","value":"6ee6b6d645bfec9cbb11556cd183ffb7dfc24cad249df6680841f1ffae256e34"},"File:762d299c0c4b536adaec4f0f8c97b550bcefa203a7216f75d58156a9765cc38f":{"type":"File","value":"762d299c0c4b536adaec4f0f8c97b550bcefa203a7216f75d58156a9765cc38f"},"File:7f8252aa2b600332c09e9583b785a569439c4d451ff6e13047c1ac02e9f3dd12":{"type":"File","value":"7f8252aa2b600332c09e9583b785a569439c4d451ff6e13047c1ac02e9f3dd12"},"File:873cb7fd11dc6f3e3afa2e75004a539cdf4bbafd45135e1730e6dc1743c3f86f":{"type":"File","value":"873cb7fd11dc6f3e3afa2e75004a539cdf4bbafd45135e1730e6dc1743c3f86f"},"File:8cbded3da97aa401c687638cd116bda42658c0564882778ba99d8fce85bcc414":{"type":"File","value":"8cbded3da97aa401c687638cd116bda42658c0564882778ba99d8fce85bcc414"},"File:9401ca6e0690c6c086788461d85f64a0b6ab368a8d0cf4e256bf78157717b918":{"type":"File","value":"9401ca6e0690c6c086788461d85f64a0b6ab368a8d0cf4e256bf78157717b918"},"File:978a3f24375d5bad636cca7aebf9d90863cfee6986853ff34a1f86e738a20dd6":{"type":"File","value":"978a3f24375d5bad636cca7aebf9d90863cfee6986853ff34a1f86e738a20dd6"},"File:a2d7bef275cef6b382ea76ddf1f6c6ae3ba80977ed31d9074dc2c5e52f7310e3":{"type":"File","value":"a2d7bef275cef6b382ea76ddf1f6c6ae3ba80977ed31d9074dc2c5e52f7310e3"},"File:a9fb7340bfc2cdd66295b8c6328d2d710f49c7386aa0a5708d6c68dcbcc0c9ff":{"type":"File","value":"a9fb7340bfc2cdd66295b8c6328d2d710f49c7386aa0a5708d6c68dcbcc0c9ff"},"File:aff10316954fffa395e1abca15cf53be222825b986d6015943b39ab45113e2c8":{"type":"File","value":"aff10316954fffa395e1abca15cf53be222825b986d6015943b39ab45113e2c8"},"File:b5704f765c8f3de2d53daf3a881682f2a7b56bb1accd42931e110ee48c1438b1":{"type":"File","value":"b5704f765c8f3de2d53daf3a881682f2a7b56bb1accd42931e110ee48c1438b1"},"File:b6a917f54cf02b5b7f1ed402a67a550150484de03696900bc43652c6c8536acf":{"type":"File","value":"b6a917f54cf02b5b7f1ed402a67a550150484de03696900bc43652c6c8536acf"},"File:c5449e9275891e821dff1e879f60d120217f7a166dc2cc62f4a1f75a68bf3b1f":{"type":"File","value":"c5449e9275891e821dff1e879f60d120217f7a166dc2cc62f4a1f75a68bf3b1f"},"File:d1b3716dc2b099fe1b548bf370da519904891c7c3f934a4d0cf66aa91956cf21":{"type":"File","value":"d1b3716dc2b099fe1b548bf370da519904891c7c3f934a4d0cf66aa91956cf21"},"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18":{"type":"File","value":"d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence","reported clean domain"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:da3ebce543ef99807bf33094f3d079960420a99a2cd31c90c1ac698fefcef261":{"type":"File","value":"da3ebce543ef99807bf33094f3d079960420a99a2cd31c90c1ac698fefcef261"},"File:db50ce65073be3c34ed8e70faf1baa2842055df4f5e00c5cc8d12d8279c3bbe6":{"type":"File","value":"db50ce65073be3c34ed8e70faf1baa2842055df4f5e00c5cc8d12d8279c3bbe6"},"File:dca7ed47e567b63cfedf02382f3a83ecdff7a100eef65454d1c55aefe72151ee":{"type":"File","value":"dca7ed47e567b63cfedf02382f3a83ecdff7a100eef65454d1c55aefe72151ee"},"File:dd0d8fd6ff6e8a7ad4fc03463a0f7c24abb21d256e1d64de8fdf9f15d1068236":{"type":"File","value":"dd0d8fd6ff6e8a7ad4fc03463a0f7c24abb21d256e1d64de8fdf9f15d1068236"},"File:e1fd8390ca835274fb3c66cb8efeed753b2c90a9c7cc580712bf542bdacf9fac":{"type":"File","value":"e1fd8390ca835274fb3c66cb8efeed753b2c90a9c7cc580712bf542bdacf9fac"},"File:e48c48db9378fa4be2f06ad5e0ae7afba1adde8c9e03f3b28be886062e2dd544":{"type":"File","value":"e48c48db9378fa4be2f06ad5e0ae7afba1adde8c9e03f3b28be886062e2dd544","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/x-x509-ca-cert"},"File:ea5294cf425b3e3181eff9a337dea128d9c7fa753cfe30490a9b2999e5de8b75":{"type":"File","value":"ea5294cf425b3e3181eff9a337dea128d9c7fa753cfe30490a9b2999e5de8b75"},"File:f316b2607cd609e0476202094d806f71e38af3f4a83f132f82e9d40d5b9629ce":{"type":"File","value":"f316b2607cd609e0476202094d806f71e38af3f4a83f132f82e9d40d5b9629ce"},"File:fa1006611233c947460b4c905fd2ae578bd2b984920dfbdb534a19f4e686c839":{"type":"File","value":"fa1006611233c947460b4c905fd2ae578bd2b984920dfbdb534a19f4e686c839"},"File:fc1ae3af0bd30b52144f085ca8a485a587e651f6f8788e9e755477b9cb66fba7":{"type":"File","value":"fc1ae3af0bd30b52144f085ca8a485a587e651f6f8788e9e755477b9cb66fba7"},"File:fcd403dcd8a010f1e92a7e3be140c394644d9cd06fc0ff9fa9f0ddd78d18570c":{"type":"File","value":"fcd403dcd8a010f1e92a7e3be140c394644d9cd06fc0ff9fa9f0ddd78d18570c"},"Ip:101.198.193.210":{"type":"Ip","value":"101.198.193.210"},"Ip:101.198.2.147":{"type":"Ip","value":"101.198.2.147"},"Ip:101.198.3.25":{"type":"Ip","value":"101.198.3.25"},"Ip:101.198.3.60":{"type":"Ip","value":"101.198.3.60"},"Ip:101.199.252.94":{"type":"Ip","value":"101.199.252.94"},"Ip:104.192.108.20":{"type":"Ip","value":"104.192.108.20"},"Ip:104.192.108.21":{"type":"Ip","value":"104.192.108.21"},"Ip:106.63.103.14":{"type":"Ip","value":"106.63.103.14"},"Ip:13.227.87.5":{"type":"Ip","value":"13.227.87.5"},"Ip:138.113.159.11":{"type":"Ip","value":"138.113.159.11"},"Ip:157.185.163.159":{"type":"Ip","value":"157.185.163.159"},"Ip:171.13.14.66":{"type":"Ip","value":"171.13.14.66"},"Ip:47.88.48.120":{"type":"Ip","value":"47.88.48.120"},"Ip:52.84.20.18":{"type":"Ip","value":"52.84.20.18"},"Url:/client/dc?m2=23f0ef3958accbbb543a1067d28c805f479293382b7e×trap=1791705540&version=1.0.0.1151&sign=7559a1b67eb038c285d2f55c50f6a005":{"type":"Url","value":"/client/dc?m2=23f0ef3958accbbb543a1067d28c805f479293382b7e×trap=1791705540&version=1.0.0.1151&sign=7559a1b67eb038c285d2f55c50f6a005"},"Url:/client/dc?m2=5bb3bf2b18d79609c79d70252dfa1a6428300b892b5d×trap=1785300253&version=1.0.0.1151&sign=4a62cf35a99c9bfb6118a3593e504b0e":{"type":"Url","value":"/client/dc?m2=5bb3bf2b18d79609c79d70252dfa1a6428300b892b5d×trap=1785300253&version=1.0.0.1151&sign=4a62cf35a99c9bfb6118a3593e504b0e"},"Url:/dm/72_72_100/t01709f600470d50b78.png":{"type":"Url","value":"/dm/72_72_100/t01709f600470d50b78.png"},"Url:/dm/72_72_100/t11eec6e52f3cc247e2e1f30741.png":{"type":"Url","value":"/dm/72_72_100/t11eec6e52f3cc247e2e1f30741.png"},"Url:/gf/360ini.cab":{"type":"Url","value":"/gf/360ini.cab"},"Url:/hips/update/inst.htm?m=5cfcd2b5c96558e492d5cc9cf988f6c6&v=2001317&s=216&r=0&d=4026520":{"type":"Url","value":"/hips/update/inst.htm?m=5cfcd2b5c96558e492d5cc9cf988f6c6&v=2001317&s=216&r=0&d=4026520"},"Url:/hips/update/inst.htm?m=5cfcd2b5c96558e492d5cc9cf988f6c6&v=2001317&s=228&r=0&d=4026520":{"type":"Url","value":"/hips/update/inst.htm?m=5cfcd2b5c96558e492d5cc9cf988f6c6&v=2001317&s=228&r=0&d=4026520"},"Url:/hips/update/inst.htm?m=5cfcd2b5c96558e492d5cc9cf988f6c6&v=2001317&s=229&r=0&d=4026520":{"type":"Url","value":"/hips/update/inst.htm?m=5cfcd2b5c96558e492d5cc9cf988f6c6&v=2001317&s=229&r=0&d=4026520"},"Url:/hips/update/inst.htm?m=5cfcd2b5c96558e492d5cc9cf988f6c6&v=2001317&s=230&r=0&d=4026520":{"type":"Url","value":"/hips/update/inst.htm?m=5cfcd2b5c96558e492d5cc9cf988f6c6&v=2001317&s=230&r=0&d=4026520"},"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=1&r=0&d=4026520&o=70":{"type":"Url","value":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=1&r=0&d=4026520&o=70"},"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=1103&r=0&d=4026520":{"type":"Url","value":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=1103&r=0&d=4026520"},"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=1104&r=0&d=4026520":{"type":"Url","value":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=1104&r=0&d=4026520"},"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=1105&r=0&d=4026520":{"type":"Url","value":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=1105&r=0&d=4026520"},"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=1200&r=0&d=4026520":{"type":"Url","value":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=1200&r=0&d=4026520"},"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=201&r=0&d=4026520":{"type":"Url","value":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=201&r=0&d=4026520"},"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=202&r=0&d=4026520":{"type":"Url","value":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=202&r=0&d=4026520"},"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=210&r=0&d=4026520":{"type":"Url","value":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=210&r=0&d=4026520"},"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=211&r=0&d=4026520":{"type":"Url","value":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=211&r=0&d=4026520"},"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=212&r=0&d=4026520":{"type":"Url","value":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=212&r=0&d=4026520"},"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=214&r=0&d=4026520":{"type":"Url","value":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=214&r=0&d=4026520"},"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=234&r=0&d=4026520":{"type":"Url","value":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=234&r=0&d=4026520"},"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=240&r=0&d=4026520":{"type":"Url","value":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=240&r=0&d=4026520"},"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=241&r=0&d=4026520":{"type":"Url","value":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=241&r=0&d=4026520"},"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=242&r=0&d=4026520":{"type":"Url","value":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=242&r=0&d=4026520"},"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=250&r=0&d=4026520":{"type":"Url","value":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=250&r=0&d=4026520"},"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=252&r=0&d=4026520":{"type":"Url","value":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=252&r=0&d=4026520"},"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=260&r=0&d=4026520":{"type":"Url","value":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=260&r=0&d=4026520"},"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=264&r=0&d=4026520":{"type":"Url","value":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=264&r=0&d=4026520"},"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=3000&r=0&d=0":{"type":"Url","value":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=3000&r=0&d=0"},"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=3001&r=0&d=0":{"type":"Url","value":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=3001&r=0&d=0"},"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=51&r=0&d=4026520":{"type":"Url","value":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=51&r=0&d=4026520"},"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=668&r=0&d=4026520":{"type":"Url","value":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=668&r=0&d=4026520"},"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=700&r=0&d=99990001":{"type":"Url","value":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=700&r=0&d=99990001"},"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=706&r=0&d=99990001":{"type":"Url","value":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=706&r=0&d=99990001"},"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=722&r=0&d=4026520":{"type":"Url","value":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=722&r=0&d=4026520"},"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=723&r=0&d=4026520":{"type":"Url","value":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=723&r=0&d=4026520"},"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&v=2001317&s=609&r=0&d=4026520":{"type":"Url","value":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&v=2001317&s=609&r=0&d=4026520"},"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&v=2001317&w=0&b=16&d=4026520&o=70":{"type":"Url","value":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&v=2001317&w=0&b=16&d=4026520&o=70"},"Url:/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=1200&r=0&d=4001959":{"type":"Url","value":"/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=1200&r=0&d=4001959"},"Url:/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=201&r=0&d=4001959":{"type":"Url","value":"/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=201&r=0&d=4001959"},"Url:/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=202&r=0&d=4001959":{"type":"Url","value":"/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=202&r=0&d=4001959"},"Url:/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=210&r=0&d=4001959":{"type":"Url","value":"/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=210&r=0&d=4001959"},"Url:/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=212&r=0&d=4001959":{"type":"Url","value":"/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=212&r=0&d=4001959"},"Url:/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=234&r=0&d=4001959":{"type":"Url","value":"/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=234&r=0&d=4001959"},"Url:/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=3000&r=0&d=0":{"type":"Url","value":"/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=3000&r=0&d=0"},"Url:/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=3001&r=0&d=0":{"type":"Url","value":"/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=3001&r=0&d=0"},"Url:/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=51&r=0&d=4001959":{"type":"Url","value":"/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=51&r=0&d=4001959"},"Url:/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=668&r=0&d=4001959":{"type":"Url","value":"/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=668&r=0&d=4001959"},"Url:/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=700&r=0&d=99990001":{"type":"Url","value":"/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=700&r=0&d=99990001"},"Url:/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=705&r=0&d=99990001":{"type":"Url","value":"/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=705&r=0&d=99990001"},"Url:/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=722&r=0&d=4001959":{"type":"Url","value":"/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=722&r=0&d=4001959"},"Url:/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=723&r=0&d=4001959":{"type":"Url","value":"/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=723&r=0&d=4001959"},"Url:/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&v=2001318&w=0&b=48&d=4001959&o=70":{"type":"Url","value":"/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&v=2001318&w=0&b=48&d=4001959&o=70"},"Url:/hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=216&r=0&d=4001959":{"type":"Url","value":"/hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=216&r=0&d=4001959"},"Url:/hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=228&r=0&d=4001959":{"type":"Url","value":"/hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=228&r=0&d=4001959"},"Url:/hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=229&r=0&d=4001959":{"type":"Url","value":"/hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=229&r=0&d=4001959"},"Url:/hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=230&r=0&d=4001959":{"type":"Url","value":"/hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=230&r=0&d=4001959"},"Url:/hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=231&r=0&d=4001959":{"type":"Url","value":"/hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=231&r=0&d=4001959"},"Url:/hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=233&r=0&d=4001959":{"type":"Url","value":"/hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=233&r=0&d=4001959"},"Url:/inst_gf_popup_ev.exe":{"type":"Url","value":"/inst_gf_popup_ev.exe"},"Url:/main/v1/silent-install/allow?ipartner=4001959&product=ws&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&only_check_reasons=":{"type":"Url","value":"/main/v1/silent-install/allow?ipartner=4001959&product=ws&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&only_check_reasons="},"Url:/main/v1/silent-install/allow?ipartner=4026520&product=ws&mid=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&only_check_reasons=":{"type":"Url","value":"/main/v1/silent-install/allow?ipartner=4026520&product=ws&mid=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&only_check_reasons="},"Url:/main/v1/ws/dlink?channel=4001959&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e&mid=aadc6efcafa1272b7bb902eeecd9eb62×tramp=1791706384&version=1.0.0.1151&sign=0b3721c7e4e0a593a9f33b408dcf38d0":{"type":"Url","value":"/main/v1/ws/dlink?channel=4001959&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e&mid=aadc6efcafa1272b7bb902eeecd9eb62×tramp=1791706384&version=1.0.0.1151&sign=0b3721c7e4e0a593a9f33b408dcf38d0"},"Url:/main/v1/ws/dlink?channel=4026520&m2=5bb3bf2b18d79609c79d70252dfa1a6428300b892b5d&mid=9f00d070765aef81d34f9f45d63251d5×tramp=1785300296&version=1.0.0.1151&sign=4f2ee8aea5585b7f3697d9e3fecdab44":{"type":"Url","value":"/main/v1/ws/dlink?channel=4026520&m2=5bb3bf2b18d79609c79d70252dfa1a6428300b892b5d&mid=9f00d070765aef81d34f9f45d63251d5×tramp=1785300296&version=1.0.0.1151&sign=4f2ee8aea5585b7f3697d9e3fecdab44"},"Url:/partner/installer.exe":{"type":"Url","value":"/partner/installer.exe"},"Url:/safe/instcomp.htm?type=onebox_setup&act=3&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e":{"type":"Url","value":"/safe/instcomp.htm?type=onebox_setup&act=3&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e"},"Url:/safe/instcomp.htm?type=onebox_setup&act=3&status=&detail=&softid=104693057&popid=&ver=&enterprise=&pid=4026520&mid=9f00d070765aef81d34f9f45d63251d5&m2=5bb3bf2b18d79609c79d70252dfa1a6428300b892b5d":{"type":"Url","value":"/safe/instcomp.htm?type=onebox_setup&act=3&status=&detail=&softid=104693057&popid=&ver=&enterprise=&pid=4026520&mid=9f00d070765aef81d34f9f45d63251d5&m2=5bb3bf2b18d79609c79d70252dfa1a6428300b892b5d"},"Url:/safe/instcomp.htm?type=onebox_setup&act=6&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e":{"type":"Url","value":"/safe/instcomp.htm?type=onebox_setup&act=6&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e"},"Url:/soft/getinfo?info=[[100100507,\"\",0]]":{"type":"Url","value":"/soft/getinfo?info=[[100100507,\"\",0]]"},"Url:/soft/getinfo?info=[[104693057,\"\",0]]":{"type":"Url","value":"/soft/getinfo?info=[[104693057,\"\",0]]"}},"chains":[{"id":"1558748957268457298","root":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence","reported clean domain"]}},{"id":"1558748955034226383","root":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","edges":[{"edge_kind":"contacted_domain","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Domain:213714e2520653597a70a79b89dcd88663260d1ab79c67ccaf9b3eb01df91eda"}],"verdict":{"verdict":"unknown"}},{"id":"1558748955034226388","root":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","edges":[{"edge_kind":"contacted_domain","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Domain:46b939a8db8b4093f8401233e25a7a09ba059c5c205a73b69fbb4f850757ef10"}],"verdict":{"verdict":"unknown"}},{"id":"1558748955034226385","root":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","edges":[{"edge_kind":"contacted_domain","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Domain:986b62f7a1c3bddd067ef8130d44370355d4e88e745b3916bbe11a23e32b8d1d"}],"verdict":{"verdict":"unknown"}},{"id":"1558748968852770496","root":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","edges":[{"edge_kind":"contacted_domain","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Domain:c9856a23b9abac2c544250ee5f9b5cbee9d53665d497f8336c22f615e78a97ab"}],"verdict":{"verdict":"clean","verdict_source":"domain reputation data","reasons":["reported clean domain"]}},{"id":"1558748955034226387","root":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:e48c48db9378fa4be2f06ad5e0ae7afba1adde8c9e03f3b28be886062e2dd544"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_network","root":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","edges":[{"edge_kind":"contacted_ip","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Ip:101.198.193.210"},{"edge_kind":"contacted_ip","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Ip:106.63.103.14"},{"edge_kind":"contacted_ip","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Ip:171.13.14.66"},{"edge_kind":"contacted_ip","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Ip:157.185.163.159"},{"edge_kind":"contacted_ip","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Ip:52.84.20.18"},{"edge_kind":"contacted_ip","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Ip:101.198.3.25"},{"edge_kind":"contacted_ip","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Ip:47.88.48.120"},{"edge_kind":"contacted_ip","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Ip:101.198.3.60"},{"edge_kind":"contacted_ip","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Ip:104.192.108.20"},{"edge_kind":"contacted_ip","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Ip:104.192.108.21"},{"edge_kind":"contacted_ip","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Ip:101.198.2.147"},{"edge_kind":"contacted_ip","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Ip:138.113.159.11"},{"edge_kind":"contacted_ip","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Ip:13.227.87.5"},{"edge_kind":"contacted_ip","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Ip:101.199.252.94"},{"edge_kind":"contacted_domain","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Domain:213714e2520653597a70a79b89dcd88663260d1ab79c67ccaf9b3eb01df91eda"},{"edge_kind":"contacted_domain","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Domain:46b939a8db8b4093f8401233e25a7a09ba059c5c205a73b69fbb4f850757ef10"},{"edge_kind":"contacted_domain","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Domain:986b62f7a1c3bddd067ef8130d44370355d4e88e745b3916bbe11a23e32b8d1d"},{"edge_kind":"contacted_domain","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Domain:c9856a23b9abac2c544250ee5f9b5cbee9d53665d497f8336c22f615e78a97ab"},{"edge_kind":"contacted_domain","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Domain:cx.soft.360.cn"},{"edge_kind":"resolves_to","from_key":"Domain:cx.soft.360.cn","to_key":"Ip:106.63.103.14"},{"edge_kind":"contacted_domain","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Domain:dl.360safe.com"},{"edge_kind":"resolves_to","from_key":"Domain:dl.360safe.com","to_key":"Ip:104.192.108.21"},{"edge_kind":"contacted_domain","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Domain:dl2.360safe.com"},{"edge_kind":"resolves_to","from_key":"Domain:dl2.360safe.com","to_key":"Ip:104.192.108.21"},{"edge_kind":"contacted_domain","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Domain:grow.safe.360.cn"},{"edge_kind":"resolves_to","from_key":"Domain:grow.safe.360.cn","to_key":"Ip:101.198.3.25"},{"edge_kind":"contacted_domain","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Domain:kittip-api.safe.360.cn"},{"edge_kind":"resolves_to","from_key":"Domain:kittip-api.safe.360.cn","to_key":"Ip:101.198.3.60"},{"edge_kind":"contacted_domain","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Domain:p0.qhimg.com"},{"edge_kind":"resolves_to","from_key":"Domain:p0.qhimg.com","to_key":"Ip:52.84.20.18"},{"edge_kind":"contacted_domain","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Domain:promotion.aiwork.360.cn"},{"edge_kind":"resolves_to","from_key":"Domain:promotion.aiwork.360.cn","to_key":"Ip:47.88.48.120"},{"edge_kind":"contacted_domain","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Domain:p6.qhimg.com"},{"edge_kind":"resolves_to","from_key":"Domain:p6.qhimg.com","to_key":"Ip:13.227.87.5"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/gf/360ini.cab"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/safe/instcomp.htm?type=onebox_setup&act=3&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/client/dc?m2=23f0ef3958accbbb543a1067d28c805f479293382b7e×trap=1791705540&version=1.0.0.1151&sign=7559a1b67eb038c285d2f55c50f6a005"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/soft/getinfo?info=[[100100507,\"\",0]]"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/dm/72_72_100/t01709f600470d50b78.png"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=700&r=0&d=99990001"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=705&r=0&d=99990001"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=3000&r=0&d=0"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=3001&r=0&d=0"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/safe/instcomp.htm?type=onebox_setup&act=6&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/main/v1/ws/dlink?channel=4001959&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e&mid=aadc6efcafa1272b7bb902eeecd9eb62×tramp=1791706384&version=1.0.0.1151&sign=0b3721c7e4e0a593a9f33b408dcf38d0"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=1200&r=0&d=4001959"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=201&r=0&d=4001959"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=234&r=0&d=4001959"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=668&r=0&d=4001959"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=722&r=0&d=4001959"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=723&r=0&d=4001959"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/main/v1/silent-install/allow?ipartner=4001959&product=ws&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&only_check_reasons="},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=51&r=0&d=4001959"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&v=2001318&w=0&b=48&d=4001959&o=70"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=202&r=0&d=4001959"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=210&r=0&d=4001959"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=212&r=0&d=4001959"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=229&r=0&d=4001959"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=228&r=0&d=4001959"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=216&r=0&d=4001959"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=230&r=0&d=4001959"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/inst_gf_popup_ev.exe"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=231&r=0&d=4001959"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=233&r=0&d=4001959"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/safe/instcomp.htm?type=onebox_setup&act=3&status=&detail=&softid=104693057&popid=&ver=&enterprise=&pid=4026520&mid=9f00d070765aef81d34f9f45d63251d5&m2=5bb3bf2b18d79609c79d70252dfa1a6428300b892b5d"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/client/dc?m2=5bb3bf2b18d79609c79d70252dfa1a6428300b892b5d×trap=1785300253&version=1.0.0.1151&sign=4a62cf35a99c9bfb6118a3593e504b0e"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/soft/getinfo?info=[[104693057,\"\",0]]"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/dm/72_72_100/t11eec6e52f3cc247e2e1f30741.png"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=700&r=0&d=99990001"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=706&r=0&d=99990001"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=3000&r=0&d=0"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=3001&r=0&d=0"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/main/v1/ws/dlink?channel=4026520&m2=5bb3bf2b18d79609c79d70252dfa1a6428300b892b5d&mid=9f00d070765aef81d34f9f45d63251d5×tramp=1785300296&version=1.0.0.1151&sign=4f2ee8aea5585b7f3697d9e3fecdab44"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=1200&r=0&d=4026520"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=201&r=0&d=4026520"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=234&r=0&d=4026520"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=668&r=0&d=4026520"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=722&r=0&d=4026520"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=723&r=0&d=4026520"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/main/v1/silent-install/allow?ipartner=4026520&product=ws&mid=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&only_check_reasons="},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=51&r=0&d=4026520"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&v=2001317&w=0&b=16&d=4026520&o=70"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=202&r=0&d=4026520"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=210&r=0&d=4026520"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=212&r=0&d=4026520"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=5cfcd2b5c96558e492d5cc9cf988f6c6&v=2001317&s=229&r=0&d=4026520"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=214&r=0&d=4026520"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=5cfcd2b5c96558e492d5cc9cf988f6c6&v=2001317&s=228&r=0&d=4026520"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=5cfcd2b5c96558e492d5cc9cf988f6c6&v=2001317&s=230&r=0&d=4026520"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=211&r=0&d=4026520"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=1103&r=0&d=4026520"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=5cfcd2b5c96558e492d5cc9cf988f6c6&v=2001317&s=216&r=0&d=4026520"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=1104&r=0&d=4026520"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=1105&r=0&d=4026520"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=250&r=0&d=4026520"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=252&r=0&d=4026520"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=1&r=0&d=4026520&o=70"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/partner/installer.exe"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=240&r=0&d=4026520"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=241&r=0&d=4026520"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=242&r=0&d=4026520"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=260&r=0&d=4026520"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&v=2001317&s=609&r=0&d=4026520"},{"edge_kind":"contacted_url","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"Url:/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=264&r=0&d=4026520"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","edges":[{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:e48c48db9378fa4be2f06ad5e0ae7afba1adde8c9e03f3b28be886062e2dd544"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:fa1006611233c947460b4c905fd2ae578bd2b984920dfbdb534a19f4e686c839"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:37fb9cfe3f0efdb59fd9ed4885cecbae676faad9d479491b9de8da8b7293e0bd"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:58fbe6a236726ab61e940b5070a68c83555bc97db4d2c8831af175dd5d1e94b6"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:7f8252aa2b600332c09e9583b785a569439c4d451ff6e13047c1ac02e9f3dd12"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:b5704f765c8f3de2d53daf3a881682f2a7b56bb1accd42931e110ee48c1438b1"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:873cb7fd11dc6f3e3afa2e75004a539cdf4bbafd45135e1730e6dc1743c3f86f"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:dd0d8fd6ff6e8a7ad4fc03463a0f7c24abb21d256e1d64de8fdf9f15d1068236"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:e1fd8390ca835274fb3c66cb8efeed753b2c90a9c7cc580712bf542bdacf9fac"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:57a9f60b95b59d06ec1c5218846c8a3a76a56750aaa81f7d63a36a8a9f794505"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:fc1ae3af0bd30b52144f085ca8a485a587e651f6f8788e9e755477b9cb66fba7"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:b6a917f54cf02b5b7f1ed402a67a550150484de03696900bc43652c6c8536acf"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:f316b2607cd609e0476202094d806f71e38af3f4a83f132f82e9d40d5b9629ce"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:3c1b6487f54212c0488c4a4b4708f5653af43a737641ffbf4bab8b84fa2e3938"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:10562de867351c45f0e1b77e3706c9a303c2c30dbf3b4b6e9fb7f8e6c63d7885"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:978a3f24375d5bad636cca7aebf9d90863cfee6986853ff34a1f86e738a20dd6"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:d1b3716dc2b099fe1b548bf370da519904891c7c3f934a4d0cf66aa91956cf21"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:130ae2654049559f882d510aa04d60dd2d76e1ba09c6941c7b15f11c75ad7437"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:03d815465762d2d74d2ba85e0df49c744920b6213d1cdb0b06aec346e74e2f18"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:4d5aa3c0aeebc3657440653df09fb4f603e813c391d6ee7739e0b8f73371b55f"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:db50ce65073be3c34ed8e70faf1baa2842055df4f5e00c5cc8d12d8279c3bbe6"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:a9fb7340bfc2cdd66295b8c6328d2d710f49c7386aa0a5708d6c68dcbcc0c9ff"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:c5449e9275891e821dff1e879f60d120217f7a166dc2cc62f4a1f75a68bf3b1f"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:58fbe6a236726ab61e940b5070a68c83555bc97db4d2c8831af175dd5d1e94b6"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:dca7ed47e567b63cfedf02382f3a83ecdff7a100eef65454d1c55aefe72151ee"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:a2d7bef275cef6b382ea76ddf1f6c6ae3ba80977ed31d9074dc2c5e52f7310e3"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:49e89cee18c70c7cee69518819ab778ef9a061fa81b0b30c3ecaaa008152cf16"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:5467b4915e771d2b3174dd42cef5bcffe6557dccbe4e8620ba261aa719f25cea"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:6ee6b6d645bfec9cbb11556cd183ffb7dfc24cad249df6680841f1ffae256e34"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:9401ca6e0690c6c086788461d85f64a0b6ab368a8d0cf4e256bf78157717b918"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:aff10316954fffa395e1abca15cf53be222825b986d6015943b39ab45113e2c8"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:26eaf0db2168de7a4a3e69cf941c421a5b417e575927ef7ad9064caec197447a"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:da3ebce543ef99807bf33094f3d079960420a99a2cd31c90c1ac698fefcef261"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:8cbded3da97aa401c687638cd116bda42658c0564882778ba99d8fce85bcc414"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:085a1aaed96d23b5ff16e09ffd8670209cddfb325d8feed9e7b6ee831af64af1"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:128de212bb214e85329581b169052cb8c963a094668a7fd2136b4d7c66e36ee0"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:762d299c0c4b536adaec4f0f8c97b550bcefa203a7216f75d58156a9765cc38f"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:ea5294cf425b3e3181eff9a337dea128d9c7fa753cfe30490a9b2999e5de8b75"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:1a94c8093239d22ad2a1211b6e8068ca52bc4f3630c67a1548d268174bfa5fe7"},{"edge_kind":"extracted","from_key":"File:d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","to_key":"File:fcd403dcd8a010f1e92a7e3be140c394644d9cd06fc0ff9fa9f0ddd78d18570c"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":30,"imported_dlls_count":104,"dropped_files_count":0,"extracted_files_count":40,"files_written_count":55,"files_deleted_count":0,"registry_keys_created_count":19,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":19,"embedded_ips_count":0,"embedded_domains_count":4,"embedded_urls_count":0,"contacted_hosts_count":14,"dns_resolutions_count":12,"contacted_urls_count":70,"http_requests_count":70},"behavior_tags":["floxif","dibizor","madang","autorun","sality","windows-server-utility","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"sandbox_reports":[{"id":"6acb401338fb4191630d74cb","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Qihoo360.K potentially unwanted application","contacted_countries":["CHN","USA"],"submit_name":"setup360压缩_100100507_4001959_csMNFx8p.exe","analysis_start_time":"2026-10-11T07:51:48+00:00","indicators_count":{"informative":276,"suspicious":84,"malicious":5},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"6a698509bca0ea95770b5374","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Qihoo360.K potentially unwanted application","contacted_countries":["CHN","USA"],"submit_name":"setupWPS Office_104693057_4026520_TvZYRN97.exe","analysis_start_time":"2026-07-29T04:43:54+00:00","indicators_count":{"informative":278,"suspicious":85,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"101.198.193.210","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"address":"106.63.103.14","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"address":"171.13.14.66","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"address":"157.185.163.159","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"address":"52.84.20.18","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"address":"101.198.3.25","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"address":"47.88.48.120","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"address":"101.198.3.60","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"address":"104.192.108.20","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"address":"104.192.108.21","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"address":"101.198.2.147","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"address":"138.113.159.11","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"address":"13.227.87.5","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"address":"101.199.252.94","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]}],"dns_resolutions":[{"domain":"s.360.cn","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"domain":"sfdl.360safe.com","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"domain":"local.info.g9hc4.cn","sources":[{"report_type":"qsp","report_id":""}]},{"domain":"bapi.safe.360.cn","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"domain":"cx.soft.360.cn","address":"106.63.103.14","ttl":300,"country":"China","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"domain":"dl.360safe.com","address":"104.192.108.21","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"domain":"dl2.360safe.com","address":"104.192.108.21","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"domain":"grow.safe.360.cn","address":"101.198.3.25","ttl":300,"country":"China","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"domain":"kittip-api.safe.360.cn","address":"101.198.3.60","ttl":300,"country":"China","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"domain":"p0.qhimg.com","address":"52.84.20.18","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"domain":"promotion.aiwork.360.cn","address":"47.88.48.120","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"domain":"p6.qhimg.com","address":"13.227.87.5","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]}],"http_requests":[{"host":"sfdl.360safe.com","host_ip":"157.185.163.159:80","url":"/gf/360ini.cab","method":"HEAD","response_code":"200","response_phrase":"OK","header":"HEAD /gf/360ini.cab HTTP/1.1\nUser-Agent: Beacon\nHost: sfdl.360safe.com\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"171.13.14.66:80","url":"/safe/instcomp.htm?type=onebox_setup&act=3&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /safe/instcomp.htm?type=onebox_setup&act=3&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e HTTP/1.1\nAccept: */*\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: s.360.cn\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"host":"bapi.safe.360.cn","host_ip":"101.198.193.210:443","url":"/client/dc?m2=23f0ef3958accbbb543a1067d28c805f479293382b7e×trap=1791705540&version=1.0.0.1151&sign=7559a1b67eb038c285d2f55c50f6a005","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /client/dc?m2=23f0ef3958accbbb543a1067d28c805f479293382b7e×trap=1791705540&version=1.0.0.1151&sign=7559a1b67eb038c285d2f55c50f6a005 HTTP/1.1\nHost: bapi.safe.360.cn\nAccept: */*\nPragma: no-cache\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"host":"cx.soft.360.cn","host_ip":"106.63.103.14:443","url":"/soft/getinfo?info=[[100100507,\"\",0]]","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /soft/getinfo?info=[[100100507,\"\",0]] HTTP/1.1\nAccept: */*\nUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; InstSoft)\nHost: cx.soft.360.cn\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"host":"p0.qhimg.com","host_ip":"52.84.20.18:80","url":"/dm/72_72_100/t01709f600470d50b78.png","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /dm/72_72_100/t01709f600470d50b78.png HTTP/1.1\nAccept: */*\nUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; InstSoft)\nHost: p0.qhimg.com\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"host":"s.360.cn","host_ip":"171.13.14.66:80","url":"/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=700&r=0&d=99990001","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=700&r=0&d=99990001 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"host":"s.360.cn","host_ip":"171.13.14.66:80","url":"/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=705&r=0&d=99990001","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=705&r=0&d=99990001 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"host":"s.360.cn","host_ip":"171.13.14.66:80","url":"/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=3000&r=0&d=0","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=3000&r=0&d=0 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"host":"s.360.cn","host_ip":"171.13.14.66:80","url":"/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=3001&r=0&d=0","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=3001&r=0&d=0 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"host":"s.360.cn","host_ip":"171.13.14.66:80","url":"/safe/instcomp.htm?type=onebox_setup&act=6&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /safe/instcomp.htm?type=onebox_setup&act=6&status=&detail=&softid=100100507&popid=&ver=&enterprise=&pid=4001959&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e HTTP/1.1\nAccept: */*\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: s.360.cn\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"host":"promotion.aiwork.360.cn","host_ip":"47.88.48.120:443","url":"/main/v1/ws/dlink?channel=4001959&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e&mid=aadc6efcafa1272b7bb902eeecd9eb62×tramp=1791706384&version=1.0.0.1151&sign=0b3721c7e4e0a593a9f33b408dcf38d0","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /main/v1/ws/dlink?channel=4001959&m2=23f0ef3958accbbb543a1067d28c805f479293382b7e&mid=aadc6efcafa1272b7bb902eeecd9eb62×tramp=1791706384&version=1.0.0.1151&sign=0b3721c7e4e0a593a9f33b408dcf38d0 HTTP/1.1\nHost: promotion.aiwork.360.cn\nAccept: */*\nPragma: no-cache\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"host":"s.360.cn","host_ip":"171.13.14.66:80","url":"/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=1200&r=0&d=4001959","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=1200&r=0&d=4001959 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"host":"s.360.cn","host_ip":"171.13.14.66:80","url":"/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=201&r=0&d=4001959","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=201&r=0&d=4001959 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"host":"s.360.cn","host_ip":"171.13.14.66:80","url":"/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=234&r=0&d=4001959","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=234&r=0&d=4001959 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"host":"s.360.cn","host_ip":"171.13.14.66:80","url":"/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=668&r=0&d=4001959","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=668&r=0&d=4001959 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"host":"s.360.cn","host_ip":"171.13.14.66:80","url":"/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=722&r=0&d=4001959","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=722&r=0&d=4001959 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"host":"s.360.cn","host_ip":"171.13.14.66:80","url":"/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=723&r=0&d=4001959","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=723&r=0&d=4001959 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"host":"kittip-api.safe.360.cn","host_ip":"101.198.3.60:443","url":"/main/v1/silent-install/allow?ipartner=4001959&product=ws&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&only_check_reasons=","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /main/v1/silent-install/allow?ipartner=4001959&product=ws&mid=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&only_check_reasons= HTTP/1.1\nHost: kittip-api.safe.360.cn\nAccept: */*\nPragma: no-cache\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"host":"s.360.cn","host_ip":"171.13.14.66:80","url":"/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=51&r=0&d=4001959","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=51&r=0&d=4001959 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"host":"s.360.cn","host_ip":"171.13.14.66:80","url":"/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&v=2001318&w=0&b=48&d=4001959&o=70","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&v=2001318&w=0&b=48&d=4001959&o=70 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"host":"s.360.cn","host_ip":"171.13.14.66:80","url":"/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=202&r=0&d=4001959","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=202&r=0&d=4001959 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"host":"s.360.cn","host_ip":"171.13.14.66:80","url":"/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=210&r=0&d=4001959","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=210&r=0&d=4001959 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"host":"s.360.cn","host_ip":"171.13.14.66:80","url":"/hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=212&r=0&d=4001959","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=aadc6efcafa1272b7bb902eeecd9eb62&m2=2ba428a414b0c496ecf8b1b2f4c9aa98365337592b60&v=2001318&s=212&r=0&d=4001959 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"host":"s.360.cn","host_ip":"171.13.14.66:80","url":"/hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=229&r=0&d=4001959","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=229&r=0&d=4001959 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"host":"s.360.cn","host_ip":"171.13.14.66:80","url":"/hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=228&r=0&d=4001959","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=228&r=0&d=4001959 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"host":"s.360.cn","host_ip":"171.13.14.66:80","url":"/hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=216&r=0&d=4001959","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=216&r=0&d=4001959 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"host":"s.360.cn","host_ip":"171.13.14.66:80","url":"/hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=230&r=0&d=4001959","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=230&r=0&d=4001959 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"host":"sfdl.360safe.com","host_ip":"157.185.163.159:80","url":"/inst_gf_popup_ev.exe","method":"HEAD","response_code":"200","response_phrase":"OK","header":"HEAD /inst_gf_popup_ev.exe HTTP/1.1\nUser-Agent: Beacon\nHost: sfdl.360safe.com\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"171.13.14.66:80","url":"/hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=231&r=0&d=4001959","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=231&r=0&d=4001959 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"host":"s.360.cn","host_ip":"171.13.14.66:80","url":"/hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=233&r=0&d=4001959","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=c9731341bc338dc071c21f32b62d1e82&v=2001318&s=233&r=0&d=4001959 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/safe/instcomp.htm?type=onebox_setup&act=3&status=&detail=&softid=104693057&popid=&ver=&enterprise=&pid=4026520&mid=9f00d070765aef81d34f9f45d63251d5&m2=5bb3bf2b18d79609c79d70252dfa1a6428300b892b5d","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /safe/instcomp.htm?type=onebox_setup&act=3&status=&detail=&softid=104693057&popid=&ver=&enterprise=&pid=4026520&mid=9f00d070765aef81d34f9f45d63251d5&m2=5bb3bf2b18d79609c79d70252dfa1a6428300b892b5d HTTP/1.1\nAccept: */*\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: s.360.cn\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"bapi.safe.360.cn","host_ip":"101.198.193.210:443","url":"/client/dc?m2=5bb3bf2b18d79609c79d70252dfa1a6428300b892b5d×trap=1785300253&version=1.0.0.1151&sign=4a62cf35a99c9bfb6118a3593e504b0e","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /client/dc?m2=5bb3bf2b18d79609c79d70252dfa1a6428300b892b5d×trap=1785300253&version=1.0.0.1151&sign=4a62cf35a99c9bfb6118a3593e504b0e HTTP/1.1\nHost: bapi.safe.360.cn\nAccept: */*\nPragma: no-cache\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"cx.soft.360.cn","host_ip":"106.63.103.14:443","url":"/soft/getinfo?info=[[104693057,\"\",0]]","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /soft/getinfo?info=[[104693057,\"\",0]] HTTP/1.1\nAccept: */*\nUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; InstSoft)\nHost: cx.soft.360.cn\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"p6.qhimg.com","host_ip":"13.227.87.5:443","url":"/dm/72_72_100/t11eec6e52f3cc247e2e1f30741.png","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /dm/72_72_100/t11eec6e52f3cc247e2e1f30741.png HTTP/1.1\nAccept: */*\nUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; InstSoft)\nHost: p6.qhimg.com\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=700&r=0&d=99990001","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=700&r=0&d=99990001 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=706&r=0&d=99990001","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=706&r=0&d=99990001 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=3000&r=0&d=0","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=3000&r=0&d=0 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=3001&r=0&d=0","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=3001&r=0&d=0 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"promotion.aiwork.360.cn","host_ip":"47.88.48.120:443","url":"/main/v1/ws/dlink?channel=4026520&m2=5bb3bf2b18d79609c79d70252dfa1a6428300b892b5d&mid=9f00d070765aef81d34f9f45d63251d5×tramp=1785300296&version=1.0.0.1151&sign=4f2ee8aea5585b7f3697d9e3fecdab44","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /main/v1/ws/dlink?channel=4026520&m2=5bb3bf2b18d79609c79d70252dfa1a6428300b892b5d&mid=9f00d070765aef81d34f9f45d63251d5×tramp=1785300296&version=1.0.0.1151&sign=4f2ee8aea5585b7f3697d9e3fecdab44 HTTP/1.1\nHost: promotion.aiwork.360.cn\nAccept: */*\nPragma: no-cache\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=1200&r=0&d=4026520","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=1200&r=0&d=4026520 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=201&r=0&d=4026520","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=201&r=0&d=4026520 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=234&r=0&d=4026520","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=234&r=0&d=4026520 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=668&r=0&d=4026520","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=668&r=0&d=4026520 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=722&r=0&d=4026520","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=722&r=0&d=4026520 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=723&r=0&d=4026520","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=723&r=0&d=4026520 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"kittip-api.safe.360.cn","host_ip":"101.199.252.94:443","url":"/main/v1/silent-install/allow?ipartner=4026520&product=ws&mid=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&only_check_reasons=","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /main/v1/silent-install/allow?ipartner=4026520&product=ws&mid=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&only_check_reasons= HTTP/1.1\nHost: kittip-api.safe.360.cn\nAccept: */*\nPragma: no-cache\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=51&r=0&d=4026520","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=51&r=0&d=4026520 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&v=2001317&w=0&b=16&d=4026520&o=70","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&v=2001317&w=0&b=16&d=4026520&o=70 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=202&r=0&d=4026520","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=202&r=0&d=4026520 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=210&r=0&d=4026520","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=210&r=0&d=4026520 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=212&r=0&d=4026520","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=212&r=0&d=4026520 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=5cfcd2b5c96558e492d5cc9cf988f6c6&v=2001317&s=229&r=0&d=4026520","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=5cfcd2b5c96558e492d5cc9cf988f6c6&v=2001317&s=229&r=0&d=4026520 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=214&r=0&d=4026520","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=214&r=0&d=4026520 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=5cfcd2b5c96558e492d5cc9cf988f6c6&v=2001317&s=228&r=0&d=4026520","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=5cfcd2b5c96558e492d5cc9cf988f6c6&v=2001317&s=228&r=0&d=4026520 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=5cfcd2b5c96558e492d5cc9cf988f6c6&v=2001317&s=230&r=0&d=4026520","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=5cfcd2b5c96558e492d5cc9cf988f6c6&v=2001317&s=230&r=0&d=4026520 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=211&r=0&d=4026520","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=211&r=0&d=4026520 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=1103&r=0&d=4026520","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=1103&r=0&d=4026520 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=5cfcd2b5c96558e492d5cc9cf988f6c6&v=2001317&s=216&r=0&d=4026520","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=5cfcd2b5c96558e492d5cc9cf988f6c6&v=2001317&s=216&r=0&d=4026520 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=1104&r=0&d=4026520","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=1104&r=0&d=4026520 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=1105&r=0&d=4026520","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=1105&r=0&d=4026520 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=250&r=0&d=4026520","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=250&r=0&d=4026520 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=252&r=0&d=4026520","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=252&r=0&d=4026520 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=1&r=0&d=4026520&o=70","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=1&r=0&d=4026520&o=70 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"dl2.360safe.com","host_ip":"104.192.108.21:80","url":"/partner/installer.exe","method":"HEAD","response_code":"200","response_phrase":"OK","header":"HEAD /partner/installer.exe HTTP/1.1\nUser-Agent: Beacon\nHost: dl2.360safe.com\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=240&r=0&d=4026520","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=240&r=0&d=4026520 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=241&r=0&d=4026520","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=241&r=0&d=4026520 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=242&r=0&d=4026520","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=242&r=0&d=4026520 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=260&r=0&d=4026520","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=260&r=0&d=4026520 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&v=2001317&s=609&r=0&d=4026520","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&v=2001317&s=609&r=0&d=4026520 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"host":"s.360.cn","host_ip":"101.198.2.147:80","url":"/hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=264&r=0&d=4026520","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hips/update/inst.htm?m=9f00d070765aef81d34f9f45d63251d5&m2=5557918b8c3334d425517eb0651631abe3958ab12bc5&v=2001317&s=264&r=0&d=4026520 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: zh-CN\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nHost: s.360.cn","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]}],"embedded_domains":[{"value":"s.360.cn","sources":[{"report_type":"qsp","report_id":""}]},{"value":"sfdl.360safe.com","sources":[{"report_type":"qsp","report_id":""}]},{"value":"local.info.g9hc4.cn","sources":[{"report_type":"qsp","report_id":""}]},{"value":"bapi.safe.360.cn","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}],"processes":[{"pid":5696,"ppid":0,"name":"setup360__100100507_4001959_csMNFx8p.exe","command_line":"","sha256":"d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18","normalized_path":"C:\\setup360__100100507_4001959_csMNFx8p.exe","uid":"00000000-00005696","icon":"$97"},{"pid":4680,"ppid":5696,"name":"zoolsfCkUdFaJ19.exe","command_line":"FF0cXRxdKV0cXRhdbV0cXTldDF0fXW1dHF0aXQhdHF04XRxdHF1kXRxdFV0uXRxdE106XR9dGF0cXRldNl0cXRJdHF0fXR5dHF0ZXRxdHF0MXQxdH10fXRxdHl1tXRxdE106XR9dGF0cXRldPl0cXRNdDF0cXSldHF0ZXQxdHF1QXVddEl0cXRxdb10cXRpdFF0cXRFdDF0cXWldHF0YXQhdHF0SXRxdH10aXRxdHl1tXRxdEF0MXRxdJF0cXRhdEF0cXQxdOl0fXR9dHF0ZXT5dHF0PXQxdHF0kXRxdGV0QXRxdEF06XRxdbl0cXRhdBF0cXTtdDF0cXTpdHF0eXW1dHF1QXVddDF0qXR9dNV0cXRpdKl0cXT9dHF0fXRddHF0aXQxdHF0NXQxdHF1tXRxdGV0cXRxdEF0cXRxdJV0cXRldNl0cXRNdDF0cXWhdHF0eXRxdHF0RXQxdH10MXRxdFV0UXRxdP10qXR9dNl0cXRVdCF0cXQRdKl0fXW1dHF0ZXW1dHF1QXVddEF0cXRxdOl0cXR5dbV0cXQ9dHF0fXS5dHF0aXSpdHF0LXTpdH10xXRxdFV0UXRxdDV0MXRxdJF0cXRldHF0cXRBdHF0cXSVdHF0ZXRBdHF0QXQxdHF1pXRxdHF0cXRxdUF1XXQ==","sha256":"fa1006611233c947460b4c905fd2ae578bd2b984920dfbdb534a19f4e686c839","normalized_path":"%TEMP%\\dJuUiFdDoMzIwBuS\\zoolsfCkUdFaJ19.exe","parent_uid":"00000000-00005696","uid":"00000000-00004680"}],"all_imported_dlls":["combase.dll","wininet.dll","VxSSL32.dll","bcryptprimitives.dll","nsi.dll","imm32.dll","wow64cpu.dll","fltLib.dll","cryptsp.dll","WindowsCodecs.dll","ncrypt.dll","360ini.dll","msimg32.dll","comctl32.dll","bcrypt.dll","cryptbase.dll","OnDemandConnRouteHelper.dll","ntdll.dll","setupapi.dll","netutils.dll","sspicli.dll","userenv.dll","netapi32.dll","NapiNSP.dll","winhttp.dll","version.dll","wow64.dll","ucrtbase.dll","shlwapi.dll","schannel.dll","ntasn1.dll","msasn1.dll","vcruntime140.dll","mswsock.dll","crypt32.dll","user32.dll","gdi32full.dll","wow64win.dll","KernelBase.dll","IPHLPAPI.DLL","win32u.dll","kernel.appcore.dll","uxtheme.dll","rasadhlp.dll","wkscli.dll","cscapi.dll","winrnr.dll","clbcatq.dll","oleaut32.dll","srvcli.dll","WinTypes.dll","DWrite.dll","rsaenh.dll","samcli.dll","pnrpnsp.dll","duser.dll","urlmon.dll","winnsi.dll","wintrust.dll","cryptnet.dll","devrtl.dll","wshbth.dll","oleacc.dll","nlansp_c.dll","winsta.dll","ExplorerFrame.dll","iertutil.dll","psapi.dll","wtsapi32.dll","apphelp.dll","advapi32.dll","msvcp140.dll","SHCore.dll","windows.storage.dll","dnsapi.dll","FWPUCLNT.DLL","ncryptsslp.dll","shell32.dll","ole32.dll","profapi.dll","atlthunk.dll","secur32.dll","wow64con.dll","rpcrt4.dll","gpapi.dll","msctf.dll","ws2_32.dll","dpapi.dll","TextShaping.dll","cabinet.dll","msvcp_win.dll","wow64base.dll","kernel32.dll","GdiPlus.dll","gdi32.dll","msvcrt.dll","sechost.dll","mskeyprotect.dll","powrprof.dll","nlaapi.dll","msIso.dll","imagehlp.dll","cfgmgr32.dll","dwmapi.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"e48c48db9378fa4be2f06ad5e0ae7afba1adde8c9e03f3b28be886062e2dd544","sha256":"e48c48db9378fa4be2f06ad5e0ae7afba1adde8c9e03f3b28be886062e2dd544","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"zoolsfCkUdFaJ19.exe","sha256":"fa1006611233c947460b4c905fd2ae578bd2b984920dfbdb534a19f4e686c839","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"360ini.dll","sha256":"37fb9cfe3f0efdb59fd9ed4885cecbae676faad9d479491b9de8da8b7293e0bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"tAgXmEoSeJkBaOaV64.tmp","sha256":"58fbe6a236726ab61e940b5070a68c83555bc97db4d2c8831af175dd5d1e94b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"360ini.cab","sha256":"7f8252aa2b600332c09e9583b785a569439c4d451ff6e13047c1ac02e9f3dd12","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"aEzTcBkCmKdVmLfV.tmp","sha256":"b5704f765c8f3de2d53daf3a881682f2a7b56bb1accd42931e110ee48c1438b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"fLpFqBsRhGgArVnV.tmp","sha256":"873cb7fd11dc6f3e3afa2e75004a539cdf4bbafd45135e1730e6dc1743c3f86f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"hImVnGlKmDnGjLmL.tmp","sha256":"dd0d8fd6ff6e8a7ad4fc03463a0f7c24abb21d256e1d64de8fdf9f15d1068236","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"jKpJoUaOaLaXlQdU.tmp","sha256":"e1fd8390ca835274fb3c66cb8efeed753b2c90a9c7cc580712bf542bdacf9fac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"kPyYmPeVcKdZuQuX.tmp","sha256":"57a9f60b95b59d06ec1c5218846c8a3a76a56750aaa81f7d63a36a8a9f794505","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"nGiRrFtZpMxQqNoG.tmp","sha256":"fc1ae3af0bd30b52144f085ca8a485a587e651f6f8788e9e755477b9cb66fba7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"tCnRvKcMxPiXmCsG.tmp","sha256":"b6a917f54cf02b5b7f1ed402a67a550150484de03696900bc43652c6c8536acf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"vMhNxQqZmMzMpKmH.tmp","sha256":"f316b2607cd609e0476202094d806f71e38af3f4a83f132f82e9d40d5b9629ce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"wTaKkScDuClLcFkJ.tmp","sha256":"3c1b6487f54212c0488c4a4b4708f5653af43a737641ffbf4bab8b84fa2e3938","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"wToKbXqMjDpTnQrZ.tmp","sha256":"10562de867351c45f0e1b77e3706c9a303c2c30dbf3b4b6e9fb7f8e6c63d7885","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"rReJyRfXoXaBlWfD.tmp","sha256":"978a3f24375d5bad636cca7aebf9d90863cfee6986853ff34a1f86e738a20dd6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"sJjYrBdMpFjVvLgW.tmp","sha256":"d1b3716dc2b099fe1b548bf370da519904891c7c3f934a4d0cf66aa91956cf21","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"eGdDyTaWtSsXjXbT.tmp","sha256":"130ae2654049559f882d510aa04d60dd2d76e1ba09c6941c7b15f11c75ad7437","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"tBxOuQaZbPdFgMdZ.tmp","sha256":"03d815465762d2d74d2ba85e0df49c744920b6213d1cdb0b06aec346e74e2f18","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"jIzTqXrVpOiYzDbT.tmp","sha256":"4d5aa3c0aeebc3657440653df09fb4f603e813c391d6ee7739e0b8f73371b55f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"cFjKlTfWoEyMnTxE.tmp","sha256":"db50ce65073be3c34ed8e70faf1baa2842055df4f5e00c5cc8d12d8279c3bbe6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"hMnXyNiJpSvPwUvQ.tmp","sha256":"a9fb7340bfc2cdd66295b8c6328d2d710f49c7386aa0a5708d6c68dcbcc0c9ff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"zoolsnNfDlHkB11.exe","sha256":"c5449e9275891e821dff1e879f60d120217f7a166dc2cc62f4a1f75a68bf3b1f","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"oKqYbDxTzTrArUkW64.tmp","sha256":"58fbe6a236726ab61e940b5070a68c83555bc97db4d2c8831af175dd5d1e94b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"fIjBaCaFeJtXqXpQ.tmp","sha256":"dca7ed47e567b63cfedf02382f3a83ecdff7a100eef65454d1c55aefe72151ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"gXuKjFkNzAzZpFvS.tmp","sha256":"a2d7bef275cef6b382ea76ddf1f6c6ae3ba80977ed31d9074dc2c5e52f7310e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"iFoHjXaXdVcLpWgQ.tmp","sha256":"49e89cee18c70c7cee69518819ab778ef9a061fa81b0b30c3ecaaa008152cf16","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"mWpOmHzHzNfFeNcM.tmp","sha256":"5467b4915e771d2b3174dd42cef5bcffe6557dccbe4e8620ba261aa719f25cea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"mXlBlCoMrCqIxXxZ.tmp","sha256":"6ee6b6d645bfec9cbb11556cd183ffb7dfc24cad249df6680841f1ffae256e34","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"qWdCxAlLmHxThOvX.tmp","sha256":"9401ca6e0690c6c086788461d85f64a0b6ab368a8d0cf4e256bf78157717b918","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"sAdMtRsKpRzKzKoP.tmp","sha256":"aff10316954fffa395e1abca15cf53be222825b986d6015943b39ab45113e2c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"tZnQbGxDcObPpCwL.tmp","sha256":"26eaf0db2168de7a4a3e69cf941c421a5b417e575927ef7ad9064caec197447a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"xQbWwWeXxJdIyKaU.tmp","sha256":"da3ebce543ef99807bf33094f3d079960420a99a2cd31c90c1ac698fefcef261","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"yDsWaFbSrKbAtSjK.tmp","sha256":"8cbded3da97aa401c687638cd116bda42658c0564882778ba99d8fce85bcc414","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"nGfZxHcWcGmIdCnM.tmp","sha256":"085a1aaed96d23b5ff16e09ffd8670209cddfb325d8feed9e7b6ee831af64af1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"hHsAlEmJqPbDkOaZ.tmp","sha256":"128de212bb214e85329581b169052cb8c963a094668a7fd2136b4d7c66e36ee0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"lWbVbFzCbRqLxByA.tmp","sha256":"762d299c0c4b536adaec4f0f8c97b550bcefa203a7216f75d58156a9765cc38f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"wRhEyYlZyXlNoShG.tmp","sha256":"ea5294cf425b3e3181eff9a337dea128d9c7fa753cfe30490a9b2999e5de8b75","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"sOuYaHjHwHnZdAoC.tmp","sha256":"1a94c8093239d22ad2a1211b6e8068ca52bc4f3630c67a1548d268174bfa5fe7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"mFeNvHlKfVeDjAeO.tmp","sha256":"fcd403dcd8a010f1e92a7e3be140c394644d9cd06fc0ff9fa9f0ddd78d18570c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\6LDIEKEG\\instcomp[1].htm","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\GPCSCCE5\\360ini[1].cab","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\360ini.cab","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"path":"%TEMP%\\cShRjRnAlKqUrKuD\\360ini.dll","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\{DFA9D2C4-7737-4cae-8AF0-66F8EC744A1B}.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\{0334FA77-0AB6-4faf-B78B-20FBFA5B0C7A}.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\{6E6591EA-77BA-4d71-9B21-ADCC7645F59E}.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\{15C79E09-A104-45d8-AB59-89430F3F61A4}.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\{4A32949F-45C3-4e75-9485-3F7E8A80B5B9}.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\{96A45189-D683-43aa-9FBD-7E71EC5B64D6}.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\{0B1C3189-F607-4afe-988E-D03DE989B182}.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\{5FDE2C7B-40F6-440c-B20E-3DDC8478DF2B}.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\{DC84D1EB-987E-495b-843D-C471C0C118D2}.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\{FB7C9708-BBEA-4df8-85AC-D603E7BFF7CC}.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\{C388D29E-7402-4b10-B05A-6D8656349490}.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\{9A1BBA4A-C1BF-45a7-B89C-3C28F7EC345A}\\hMnXyNiJpSvPwUvQ.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\{65B13211-0640-4aaa-A71A-4BF3A857408D}\\eGdDyTaWtSsXjXbT.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\{246E7342-393D-4448-8318-EEEA3041C158}\\rReJyRfXoXaBlWfD.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\{EA375CF2-F672-4f0d-9A08-D5C5C210E0E3}\\iAbMqWtFwQeEaCeH.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\{7B1BD9AD-130E-49c5-ADF7-58699C91ADA9}\\tBxOuQaZbPdFgMdZ.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\{82AF3990-9FBB-489a-925D-28D23E80B603}\\jIzTqXrVpOiYzDbT.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\{9583EEE7-A8EF-45a8-B12A-B2ACCEF71DFA}\\cFjKlTfWoEyMnTxE.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\{5F42191E-ED9F-46b8-A6F8-C2D5B19ADAA3}\\sJjYrBdMpFjVvLgW.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\{C814AC6F-9E52-46a0-91C1-46AD0AF54FFD}\\uByHuTdFoDtWhDrQ.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\{CCE4424F-4CF1-404a-8845-ACD5D480B413}\\tUuBpVvYiEdKlMtV.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\tCgYoIzDrEnQzOlA\\{07B7A04F-D3A0-4f04-BBC6-ABB4C39F2385}.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\bYkUmRdAnXyVtFmU\\{6761544E-10E5-402b-8E9D-19441F4A321A}.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\xMnDeFzPmNcWnHyW\\{05742C70-FEA7-4cd6-A8EF-0CE4C813CF17}.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\xElJmWgDcMiUoNwL\\{63FF1E40-A111-4e68-8BD4-E666C1919AB1}.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\xHwFyRtUcFqKfKwF\\{D4E54323-FA34-43f5-AC1E-4B9C02A1CC27}.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\qCjWmBgGhZuZvDmE\\{358E60E3-97B4-4e61-B7E1-11F3A262A6C6}.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\kKaNnBpObZhGbBoN\\{142EDD5F-90E7-456d-A8AC-C4BCB90503D0}.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\hFvZnRjQiNmQlBpA\\{DE36F986-015A-4596-9DF1-7826386D8613}.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\gPeVeWqOdJhIyTfC\\{33397BD2-B7BD-4307-98A9-7F6848371C71}.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\hImVnGlKmDnGjLmL.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\jKpJoUaOaLaXlQdU.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\vMhNxQqZmMzMpKmH.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\nGiRrFtZpMxQqNoG.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\wTaKkScDuClLcFkJ.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\tCnRvKcMxPiXmCsG.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\kPyYmPeVcKdZuQuX.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\wToKbXqMjDpTnQrZ.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\aEzTcBkCmKdVmLfV.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%TEMP%\\fLpFqBsRhGgArVnV.tmp","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\3SXYTHIH\\instcomp[1].htm","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\instcomp[1].htm","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\9SSPAW46\\360ini[1].cab","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"path":"%TEMP%\\dYmVtJfDyVoDaWgC\\360ini.dll","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5696:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"1830B7BD-F7A3-4c4d-989B-C004DE465EDE 5696","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"Local\\SM0:5696:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"{EF05DB74-1623-48f2-B923-8738727916C1}","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"Local\\SM0:5696:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"{A2CE3D3C-15E7-4985-B2C5-58F681DD07A5}","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"SM0:5696:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"SM0:5696:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5696:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{A2CE3D3C-15E7-4985-B2C5-58F681DD07A5}","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 5696","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5696:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{EF05DB74-1623-48f2-B923-8738727916C1}","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5696:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"},{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4680:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"Local\\SM0:4680:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6acb401338fb4191630d74cb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 1160","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"{6D98B0AA-6D75-486b-8E8F-12CBA7E2327F}","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"1830B7BD-F7A3-4c4d-989B-C004DE465EDE 1160","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"Local\\SM0:1160:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"SM0:1160:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1160:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1160:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{6D98B0AA-6D75-486b-8E8F-12CBA7E2327F}","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 8132","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]},{"name":"1830B7BD-F7A3-4c4d-989B-C004DE465EDE 8132","sources":[{"report_type":"sandbox","report_id":"6a698509bca0ea95770b5374"}]}]}},"report_ids":{"sandbox_job_ids":["6acb401338fb4191630d74cb","6a698509bca0ea95770b5374"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Win32_Qihoo360_K_potentially_unwanted_application Sample d99eb978d6c2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d99eb978d6c2…. Malware family: Win32_Qihoo360_K_potentially_unwanted_application. Threat score 100/100. 6/24 AV engines flagged this file. 10 malicious and 27 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18"}],["$","meta","4",{"property":"og:title","content":"Malicious Win32_Qihoo360_K_potentially_unwanted_application Sample d99eb978d6c2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d99eb978d6c2…. Malware family: Win32_Qihoo360_K_potentially_unwanted_application. Threat score 100/100. 6/24 AV engines flagged this file. 10 malicious and 27 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win32_Qihoo360_K_potentially_unwanted_application Sample d99eb978d6c2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d99eb978d6c2…. Malware family: Win32_Qihoo360_K_potentially_unwanted_application. Threat score 100/100. 6/24 AV engines flagged this file. 10 malicious and 27 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L98","11",{}]] 32:null