a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d

Analysis

max time kernel
151s
max time network
146s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 19:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
Size

668KB
MD5

0dd06752be38f3b39d85ca91e9165c40
SHA1

9932cf07592dab1adc6426e53a12d8ebf8743e78
SHA256

a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d
SHA512

176cb6115cfa2cd7bbdbed97c26ab051ae332c57910ae3d51e79cb577b0b6a26bb950a2a89de1af48ae50600ed1fe5687ed31341b676d74430fdd849e1c9b51c
SSDEEP

12288:n6ETd/o2EDrAnpxfgr3tgRKc6svHfP/K0Ie86tdyD9A+RtOkyiAs3BgQgB:nFThp6sv/PC0Vte9XO55s3BAB

Score

10^/10

adware bootkit cryptone discovery packer persistence stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

SoftupNotify.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\SoftMgrExt	SoftupNotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\SoftMgrExt\ = "{5E19C0CE-C02C-46c2-98C3-A2E12EDE0E17}"	SoftupNotify.exe

CryptOne packer 1 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

Processes:

resource	yara_rule
C:\Program Files (x86)\360\360Safe\deepscan\cloudcom2.dll	cryptone

Downloads MZ/PE file

Drops file in Drivers directory 9 IoCs

Processes:

zhudongfangyu.exe360safe.exe360tray.exe

description	ioc	process
File created	C:\Windows\system32\drivers\efimon.sys	zhudongfangyu.exe
File created	C:\Windows\system32\drivers\efimon.sys	360safe.exe
File created	C:\Windows\system32\drivers\360FsFlt.sys	zhudongfangyu.exe
File opened for modification	C:\Windows\system32\drivers\360FsFlt.sys	zhudongfangyu.exe
File created	C:\Windows\system32\drivers\360AntiHacker64.sys	360safe.exe
File created	C:\Windows\system32\drivers\BAPIDRV64.SYS	360safe.exe
File created	C:\Windows\system32\drivers\efimon.sys	360tray.exe
File created	C:\Windows\system32\drivers\360netmon.sys	360safe.exe
File created	C:\Windows\system32\drivers\360Box64.sys	360safe.exe

Executes dropped EXE 14 IoCs

Processes:

360safe.exe360box_3.0.0.1010.exezhudongfangyu.exezhudongfangyu.exe360se.exe360tray.exeSoftupNotify.exebd_work.exe360se_chs.exeSoftMgrProxy64.exeseup.exe360se.exe360se_chs.exe360tray.exe

pid	process
688	360safe.exe
1320	360box_3.0.0.1010.exe
972	zhudongfangyu.exe
868	zhudongfangyu.exe
1120	360se.exe
1476	360tray.exe
1056	SoftupNotify.exe
1796	bd_work.exe
1472	360se_chs.exe
2056	SoftMgrProxy64.exe
2444	seup.exe
2456	360se.exe
2488	360se_chs.exe
2656	360tray.exe

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

360safe.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2A650B6F-1548-4294-AB07-F17604108156}\InprocServer32	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D8A9DF39-075A-4C8C-B48B-8121C37FFDF0}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7C0F6D57-E799-4C8A-A319-8E2B4D724CF0}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0AB8231-8E73-410D-8D1C-BE1027EA19A3}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0AB8231-8E73-410D-8D1C-BE1027EA19A3}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E431A037-AE60-4D57-99D7-B402223AE8A0}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{78A1990F-7561-4CB9-A8BF-B6CCF8AAEB97}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CC00F81D-5262-450A-B1FA-D6BEE3406263}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0AB8231-8E73-410D-8D1C-BE1027EA19A3}\InprocServer32	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C0B3184D-90C8-4F4D-B19A-42B6C659378B}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{55F9A4E2-52B3-4743-9EA7-2FEE413DABB6}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4D88ED58-E7F0-4EF2-AE06-5D5873AD19C6}\InprocServer32	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{78A1990F-7561-4CB9-A8BF-B6CCF8AAEB97}\InprocServer32	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12793398-A212-446F-BA1E-1F1B5ABDB89C}\InprocServer32	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{47F57C45-E7A1-4414-A6F0-A0865F6E4CA6}\InprocServer32	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63A39D0C-0B63-49EE-BB21-D106ED548C51}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CC00F81D-5262-450A-B1FA-D6BEE3406263}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FD6A8A28-DB7F-478C-A358-C989EFE02096}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{039219EC-5F9A-460E-8C72-86D5DC7B8683}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E431A037-AE60-4D57-99D7-B402223AE8A0}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{056A6FBD-8148-443A-AAB2-DB3C46B1F083}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{47F57C45-E7A1-4414-A6F0-A0865F6E4CA6}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7C0F6D57-E799-4C8A-A319-8E2B4D724CF0}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7A148181-CEB9-4F5E-B5F2-CDC5B68BD3A8}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12793398-A212-446F-BA1E-1F1B5ABDB89C}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6A377734-9D9D-44AE-A69C-06E81F6C8064}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6BC477E-2646-459A-9D6A-75902C24430D}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2A650B6F-1548-4294-AB07-F17604108156}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE3F69E2-3085-4C46-B050-A45F008827D6}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E715FE74-087F-4F4C-BB0A-0245C8A897E2}\InprocServer32	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E715FE74-087F-4F4C-BB0A-0245C8A897E2}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E715FE74-087F-4F4C-BB0A-0245C8A897E2}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{55F9A4E2-52B3-4743-9EA7-2FEE413DABB6}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D8A9DF39-075A-4C8C-B48B-8121C37FFDF0}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{826D8B56-A99E-4CD2-8F38-CFCE2A7B89C4}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C9A94B6A-60FB-4A19-8BA3-4A2068F1026D}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FA1B1706-967F-4834-8405-2343A38E4086}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE3F69E2-3085-4C46-B050-A45F008827D6}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6A377734-9D9D-44AE-A69C-06E81F6C8064}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE3F69E2-3085-4C46-B050-A45F008827D6}\InprocServer32	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4D88ED58-E7F0-4EF2-AE06-5D5873AD19C6}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C9A94B6A-60FB-4A19-8BA3-4A2068F1026D}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2A650B6F-1548-4294-AB07-F17604108156}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D8A9DF39-075A-4C8C-B48B-8121C37FFDF0}\InprocServer32	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FD6A8A28-DB7F-478C-A358-C989EFE02096}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FA1B1706-967F-4834-8405-2343A38E4086}\InprocServer32	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7A148181-CEB9-4F5E-B5F2-CDC5B68BD3A8}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEE8C32E-C785-4B1F-A33B-FCD6942418BD}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FD6A8A28-DB7F-478C-A358-C989EFE02096}\InprocServer32	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{056A6FBD-8148-443A-AAB2-DB3C46B1F083}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF1859F5-DF30-4EEC-9404-E5F32FD260B7}\InprocServer32	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF1859F5-DF30-4EEC-9404-E5F32FD260B7}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{86A06468-8A7C-4EFA-A61C-9C0E911194C9}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63A39D0C-0B63-49EE-BB21-D106ED548C51}\InprocServer32	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{26CD0715-0722-479B-A8C7-29A911171774}\InProcServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\Utils\\shell360ext64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7A148181-CEB9-4F5E-B5F2-CDC5B68BD3A8}\InprocServer32	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{039219EC-5F9A-460E-8C72-86D5DC7B8683}\InprocServer32	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E431A037-AE60-4D57-99D7-B402223AE8A0}\InprocServer32	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A23CB8EB-C9C4-475D-88C0-CC51933F2D9E}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D1FD8167-E560-4B08-9F4E-CA89F979BD84}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A23CB8EB-C9C4-475D-88C0-CC51933F2D9E}\InprocServer32	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D1FD8167-E560-4B08-9F4E-CA89F979BD84}\InprocServer32	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C0B3184D-90C8-4F4D-B19A-42B6C659378B}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF1859F5-DF30-4EEC-9404-E5F32FD260B7}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe

Sets service image path in registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

360tray.exe360safe.exezhudongfangyu.exezhudongfangyu.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\360FsFlt\ImagePath = "system32\\DRIVERS\\360FsFlt.sys"	360tray.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\360AntiHacker\ImagePath = "System32\\Drivers\\360AntiHacker64.sys"	360tray.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\360Box64\ImagePath = "system32\\DRIVERS\\360Box64.sys"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ZhuDongFangYu\ImagePath = "\"C:\\Program Files (x86)\\360\\360Safe\\deepscan\\zhudongfangyu.exe\""	zhudongfangyu.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\BAPIDRV\ImagePath = "\\SystemRoot\\System32\\Drivers\\BAPIDRV64.SYS"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\360FsFlt\ImagePath = "system32\\DRIVERS\\360FsFlt.sys"	zhudongfangyu.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\360FsFlt\ImagePath = "system32\\DRIVERS\\360FsFlt.sys"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\BAPIDRV\ImagePath = "\\SystemRoot\\System32\\Drivers\\BAPIDRV64.SYS"	360tray.exe

Loads dropped DLL 64 IoCs

Processes:

a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe360safe.exe360box_3.0.0.1010.exeregsvr32.exezhudongfangyu.exe360se.exe

pid	process
1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
688	360safe.exe
688	360safe.exe
1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
1320	360box_3.0.0.1010.exe
1320	360box_3.0.0.1010.exe
1320	360box_3.0.0.1010.exe
1320	360box_3.0.0.1010.exe
1320	360box_3.0.0.1010.exe
1320	360box_3.0.0.1010.exe
1320	360box_3.0.0.1010.exe
1320	360box_3.0.0.1010.exe
1320	360box_3.0.0.1010.exe
688	360safe.exe
688	360safe.exe
688	360safe.exe
688	360safe.exe
688	360safe.exe
688	360safe.exe
688	360safe.exe
688	360safe.exe
688	360safe.exe
688	360safe.exe
688	360safe.exe
688	360safe.exe
688	360safe.exe
688	360safe.exe
1796	regsvr32.exe
688	360safe.exe
688	360safe.exe
688	360safe.exe
688	360safe.exe
688	360safe.exe
688	360safe.exe
688	360safe.exe
688	360safe.exe
688	360safe.exe
868	zhudongfangyu.exe
868	zhudongfangyu.exe
868	zhudongfangyu.exe
688	360safe.exe
868	zhudongfangyu.exe
688	360safe.exe
688	360safe.exe
688	360safe.exe
868	zhudongfangyu.exe
688	360safe.exe
868	zhudongfangyu.exe
688	360safe.exe
688	360safe.exe
688	360safe.exe
688	360safe.exe
1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
1120	360se.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

360safe.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\360Safetray = "\"C:\\Program Files (x86)\\360\\360Safe\\safemon\\360Tray.exe\" /start"	360safe.exe

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1063

Processes:

a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\ESET\Nod\CurrentVersion\Modules\Imon\Settings\Config000\Settings	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

360tray.exe

description	ioc	process
File opened (read-only)	\??\w:	360tray.exe
File opened (read-only)	\??\x:	360tray.exe
File opened (read-only)	\??\e:	360tray.exe
File opened (read-only)	\??\i:	360tray.exe
File opened (read-only)	\??\j:	360tray.exe
File opened (read-only)	\??\l:	360tray.exe
File opened (read-only)	\??\q:	360tray.exe
File opened (read-only)	\??\t:	360tray.exe
File opened (read-only)	\??\y:	360tray.exe
File opened (read-only)	\??\o:	360tray.exe
File opened (read-only)	\??\u:	360tray.exe
File opened (read-only)	\??\f:	360tray.exe
File opened (read-only)	\??\r:	360tray.exe
File opened (read-only)	\??\s:	360tray.exe
File opened (read-only)	\??\g:	360tray.exe
File opened (read-only)	\??\h:	360tray.exe
File opened (read-only)	\??\k:	360tray.exe
File opened (read-only)	\??\m:	360tray.exe
File opened (read-only)	\??\n:	360tray.exe
File opened (read-only)	\??\p:	360tray.exe
File opened (read-only)	\??\v:	360tray.exe
File opened (read-only)	\??\z:	360tray.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

360safe.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}	360safe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}\NoExplorer = "1"	360safe.exe

Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

360safe.exe360se_chs.exeseup.exe360se_chs.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	360safe.exe
File opened for modification	\??\PhysicalDrive0	360se_chs.exe
File opened for modification	\??\PhysicalDrive0	seup.exe
File opened for modification	\??\PhysicalDrive0	360se_chs.exe

Drops file in System32 directory 1 IoCs

Processes:

360safe.exe

description ioc process

File created C:\Windows\SysWOW64\360SoftMgr.cpl 360safe.exe

description	ioc	process
File created	C:\Windows\SysWOW64\360SoftMgr.cpl	360safe.exe

Drops file in Program Files directory 26 IoCs

Processes:

360safe.exe360tray.exezhudongfangyu.exeSoftupNotify.exe

description	ioc	process
File created	C:\Program Files (x86)\360\360Safe\config\uninst\360safe.setup	360safe.exe
File created	C:\Program Files (x86)\360\360Safe\config\uninst\Register.xml	360safe.exe
File created	C:\Program Files (x86)\360\360Safe\config\uninstbackup\filelist.xml	360safe.exe
File created	C:\Program Files (x86)\360\360Safe\config\uninstbackup\UninstallRootDirFileList.xml	360safe.exe
File opened for modification	C:\Program Files (x86)\360\360Safe\netmon\360netmon.ini	360tray.exe
File opened for modification	C:\Program Files (x86)\360\360Safe\updatecfg.ini	360safe.exe
File created	C:\Program Files (x86)\360\360Safe\config\uninst\filelist.xml	360safe.exe
File created	C:\Program Files (x86)\360\360Safe\config\uninst\UninstallRootDirFileList.xml	360safe.exe
File opened for modification	C:\Program Files (x86)\360\360Safe\safemon\param.ini	360safe.exe
File opened for modification	C:\Program Files (x86)\360\360Safe\AntiArp\dpath.ini	360safe.exe
File created	C:\Program Files (x86)\360\360Safe\safemon\7z.dll	360safe.exe
File opened for modification	C:\Program Files (x86)\360\360Safe\deepscan\speedmem2.hg	zhudongfangyu.exe
File opened for modification	C:\Program Files (x86)\360\360Safe\deepscan\speedmem2.hg-journal	zhudongfangyu.exe
File created	C:\Program Files (x86)\360\360Safe\wftest.tf	360safe.exe
File opened for modification	C:\Program Files (x86)\360\360Safe\updatecfg.ini	360tray.exe
File created	C:\Program Files (x86)\360\360Safe\config\uninstbackup\360safe.setup	360safe.exe
File created	C:\Program Files (x86)\360\360Safe\config\uninstbackup\Register.xml	360safe.exe
File created	C:\Program Files (x86)\360\360Safe\MiniUI.dll	360safe.exe
File created	C:\Program Files (x86)\360\360Safe\SoftMgr\强力卸载电脑上的软件.lnk	SoftupNotify.exe
File opened for modification	C:\Program Files (x86)\360\360Safe\SoftMgr\LiveInst.ini	SoftupNotify.exe
File created	C:\Program Files (x86)\360\360Safe\360safe.setup.log	360safe.exe
File created	C:\Program Files (x86)\360\360Safe\config\uninstbackup\Plugin.xml	360safe.exe
File opened for modification	C:\Program Files (x86)\360\360Safe\360safe.setup.log	360safe.exe
File opened for modification	C:\Program Files (x86)\360\360Safe\SoftMgr\Config.ini	SoftupNotify.exe
File opened for modification	C:\Program Files (x86)\360\360Safe\LiveUpdateLog\360tray.log	360tray.exe
File created	C:\Program Files (x86)\360\360Safe\config\uninst\Plugin.xml	360safe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 6 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\360box_3.0.0.1010.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\360box_3.0.0.1010.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\360box_3.0.0.1010.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\360box_3.0.0.1010.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\360box_3.0.0.1010.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\360box_3.0.0.1010.exe	nsis_installer_1

Modifies Control Panel 2 IoCs

evasion

Processes:

SoftupNotify.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\don't load	SoftupNotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\don't load\360SoftMgr.cpl = "NO"	SoftupNotify.exe

Modifies Internet Explorer settings 1 TTPs 44 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exe360se_chs.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	360se_chs.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND\360se.exe = "1"	360se_chs.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6A19DF41-5E4B-11ED-9C7C-660C31E8D015} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	360se_chs.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL	360se_chs.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL\360se.exe = "1"	360se_chs.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND	360se_chs.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "374556328"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\AllSitesCompatibilityMode = "0"	360se_chs.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	360se_chs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Check_Associations = "no"	360se_chs.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Modifies registry class 64 IoCs

Processes:

360safe.exe360tray.exeregsvr32.exeSoftupNotify.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{55F9A4E2-52B3-4743-9EA7-2FEE413DABB6}\InprocServer32\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D8A9DF39-075A-4C8C-B48B-8121C37FFDF0}\DefaultIcon	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A23CB8EB-C9C4-475D-88C0-CC51933F2D9E}\DefaultIcon\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll,1"	360safe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\https\shell\ = "360SE.exe"	360tray.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\360seURL\shell\ = "open"	360tray.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C0B3184D-90C8-4F4D-B19A-42B6C659378B}\Shell\Open\Icon = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll,0"	360safe.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.htm	360tray.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D8A9DF39-075A-4C8C-B48B-8121C37FFDF0}\Shell\Open\Icon = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll,0"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6A377734-9D9D-44AE-A69C-06E81F6C8064}\ShellEx\ContextMenuHandlers	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4D88ED58-E7F0-4EF2-AE06-5D5873AD19C6}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{87515F61-A66C-4319-A0E0-D416CB8059E3}\TypeLib	360tray.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C360MMPlugIn.Manager\CurVer\ = "C360MMPlugIn.Manager.1"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}\TypeLib\ = "{BB67E9B5-A1A3-4206-A443-DE93D592682C}"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{051590AC-0B42-41A6-85B3-0BF137140B4B}\ProxyStubClsid32	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0AB8231-8E73-410D-8D1C-BE1027EA19A3}\Shell	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D8A9DF39-075A-4C8C-B48B-8121C37FFDF0}\Shell	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4D88ED58-E7F0-4EF2-AE06-5D5873AD19C6}\Shell\Open\command\ = "%SystemRoot%\\explorer.exe X:\\"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell	360tray.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{26CD0715-0722-479B-A8C7-29A911171774}\ = "IShellContextMenu"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C0B3184D-90C8-4F4D-B19A-42B6C659378B}\Shell\Open\ = "打开U盘 (&O)"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D8A9DF39-075A-4C8C-B48B-8121C37FFDF0}\ = "我的U盘 (S:)"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A23CB8EB-C9C4-475D-88C0-CC51933F2D9E}\Shell\Open	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{93E84A56-42D5-43F3-B224-8B019BCD6250}\TypeLib	360safe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{47F57C45-E7A1-4414-A6F0-A0865F6E4CA6}\ShellFolder\Attributes = "536870912"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CC00F81D-5262-450A-B1FA-D6BEE3406263}\ = "360UDiskGuard Icon Overlay"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{42133F20-66FA-4755-9B06-35D6CE360630}\1.0\ = "SAFELIVELib"	360tray.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\Safe360Ext\ = "{7C0F6D57-E799-4C8A-A319-8E2B4D724CF0}"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12793398-A212-446F-BA1E-1F1B5ABDB89C}\Shell\ = "Open"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FD6A8A28-DB7F-478C-A358-C989EFE02096}\DefaultIcon\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll,1"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{42133F20-66FA-4755-9B06-35D6CE360630}\1.0\0\win32\ = "C:\\Program Files (x86)\\360\\360Safe\\Safelive.dll"	360tray.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\https\shell\360SE.exe	360tray.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\file\shell\360SE.exe\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\360se\\bin\\360SE.exe\" \"%1\""	360tray.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{55F9A4E2-52B3-4743-9EA7-2FEE413DABB6}\Shell\Open	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\360SafeLive.Update.2	360tray.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{76C72A7C-C0A6-4171-B3E4-6BD181AF41B6}\ = "IAxObj"	360tray.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\360seURL	360tray.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27AD6078-180A-4924-BB11-9C3DA8A42C05}\Programmable	360safe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{039219EC-5F9A-460E-8C72-86D5DC7B8683}\ShellFolder\Attributes = "536870912"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{056A6FBD-8148-443A-AAB2-DB3C46B1F083}\ShellEx	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{55F9A4E2-52B3-4743-9EA7-2FEE413DABB6}\ShellEx	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\SMWebProxy.DLL\AppID = "{EBCEF9D3-7E53-4F2E-AB6C-278D56EB1E5E}"	SoftupNotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C3E057B8-E66F-406D-B1FB-D8DB4FA579DB}\1.0\FLAGS	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{55F9A4E2-52B3-4743-9EA7-2FEE413DABB6}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D1FD8167-E560-4B08-9F4E-CA89F979BD84}\ = "360 USB Disk Protector Contextmenu"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{826D8B56-A99E-4CD2-8F38-CFCE2A7B89C4}\Shell\Open\command\ = "%SystemRoot%\\explorer.exe B:\\"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FA1B1706-967F-4834-8405-2343A38E4086}\InprocServer32	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FD6A8A28-DB7F-478C-A358-C989EFE02096}\Shell\Open	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{056A6FBD-8148-443A-AAB2-DB3C46B1F083}\Shell\Open\ = "打开U盘 (&O)"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63A39D0C-0B63-49EE-BB21-D106ED548C51}\ShellEx	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2A650B6F-1548-4294-AB07-F17604108156}\ShellEx\	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE3F69E2-3085-4C46-B050-A45F008827D6}\Shell\Open\Icon = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll,0"	360safe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\InternetShortcut\shell\ = "open"	360tray.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7418AFE6-6A10-479B-99FA-4AE0D39026A9}\1.0\HELPDIR	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7A148181-CEB9-4F5E-B5F2-CDC5B68BD3A8}\DefaultIcon\ = "C:\\Program Files (x86)\\360\\360Safe\\safemon\\360UDiskGuard64.dll,1"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FA1B1706-967F-4834-8405-2343A38E4086}\Shell	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8A2F4270-9FED-4DE0-A8F8-CA8BECFD7AB0}	SoftupNotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Safe360Ext\ = "{7C0F6D57-E799-4C8A-A319-8E2B4D724CF0}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93E84A56-42D5-43F3-B224-8B019BCD6250}\TypeLib\Version = "1.0"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{051590AC-0B42-41A6-85B3-0BF137140B4B}\ = "ICheckURL"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{039219EC-5F9A-460E-8C72-86D5DC7B8683}\InprocServer32\ThreadingModel = "Apartment"	360safe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{55F9A4E2-52B3-4743-9EA7-2FEE413DABB6}\Shell\Open\command	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D8A9DF39-075A-4C8C-B48B-8121C37FFDF0}\Shell\ = "Open"	360safe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A23CB8EB-C9C4-475D-88C0-CC51933F2D9E}\Shell\ = "Open"	360safe.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

360tray.exe360se_chs.exe

pid	process
1476	360tray.exe
1476	360tray.exe
1476	360tray.exe
1476	360tray.exe
1472	360se_chs.exe
1472	360se_chs.exe
1472	360se_chs.exe
1472	360se_chs.exe
1476	360tray.exe

Suspicious behavior: LoadsDriver 15 IoCs

Processes:

pid process

460
460
460
460
460
460
460
460
460
460
460
460
460
460
460

pid	process
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460

Suspicious use of AdjustPrivilegeToken 17 IoCs

Processes:

360safe.exezhudongfangyu.exe360tray.exebd_work.exea58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe

description	pid	process
Token: SeDebugPrivilege	688	360safe.exe
Token: SeDebugPrivilege	688	360safe.exe
Token: SeDebugPrivilege	688	360safe.exe
Token: SeDebugPrivilege	868	zhudongfangyu.exe
Token: SeDebugPrivilege	1476	360tray.exe
Token: SeDebugPrivilege	1476	360tray.exe
Token: SeDebugPrivilege	1476	360tray.exe
Token: SeDebugPrivilege	1476	360tray.exe
Token: SeDebugPrivilege	1476	360tray.exe
Token: SeRestorePrivilege	1796	bd_work.exe
Token: SeBackupPrivilege	1796	bd_work.exe
Token: 33	1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
Token: SeIncBasePriorityPrivilege	1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
Token: 33	1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
Token: SeIncBasePriorityPrivilege	1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
Token: 33	1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
Token: SeIncBasePriorityPrivilege	1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe

Suspicious use of FindShellTrayWindow 14 IoCs

Processes:

a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exeiexplore.exe360tray.exeSoftMgrProxy64.exe

pid	process
1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
824	iexplore.exe
1476	360tray.exe
2056	SoftMgrProxy64.exe
2056	SoftMgrProxy64.exe
1476	360tray.exe
1476	360tray.exe
1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe360tray.exeSoftMgrProxy64.exe

pid	process
1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
1476	360tray.exe
2056	SoftMgrProxy64.exe
1476	360tray.exe
1476	360tray.exe
1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

iexplore.exeIEXPLORE.EXE360tray.exeSoftMgrProxy64.exe360tray.exe

pid	process
824	iexplore.exe
824	iexplore.exe
1004	IEXPLORE.EXE
1004	IEXPLORE.EXE
1004	IEXPLORE.EXE
1004	IEXPLORE.EXE
1476	360tray.exe
1476	360tray.exe
1476	360tray.exe
2056	SoftMgrProxy64.exe
2656	360tray.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe360box_3.0.0.1010.exeiexplore.exe360safe.exe360se.exebd_work.exe360tray.exe360se_chs.exe

description	pid	process	target process
PID 1212 wrote to memory of 688	1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe	360safe.exe
PID 1212 wrote to memory of 688	1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe	360safe.exe
PID 1212 wrote to memory of 688	1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe	360safe.exe
PID 1212 wrote to memory of 688	1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe	360safe.exe
PID 1212 wrote to memory of 688	1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe	360safe.exe
PID 1212 wrote to memory of 688	1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe	360safe.exe
PID 1212 wrote to memory of 688	1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe	360safe.exe
PID 1212 wrote to memory of 1320	1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe	360box_3.0.0.1010.exe
PID 1212 wrote to memory of 1320	1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe	360box_3.0.0.1010.exe
PID 1212 wrote to memory of 1320	1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe	360box_3.0.0.1010.exe
PID 1212 wrote to memory of 1320	1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe	360box_3.0.0.1010.exe
PID 1320 wrote to memory of 824	1320	360box_3.0.0.1010.exe	iexplore.exe
PID 1320 wrote to memory of 824	1320	360box_3.0.0.1010.exe	iexplore.exe
PID 1320 wrote to memory of 824	1320	360box_3.0.0.1010.exe	iexplore.exe
PID 1320 wrote to memory of 824	1320	360box_3.0.0.1010.exe	iexplore.exe
PID 824 wrote to memory of 1004	824	iexplore.exe	IEXPLORE.EXE
PID 824 wrote to memory of 1004	824	iexplore.exe	IEXPLORE.EXE
PID 824 wrote to memory of 1004	824	iexplore.exe	IEXPLORE.EXE
PID 824 wrote to memory of 1004	824	iexplore.exe	IEXPLORE.EXE
PID 688 wrote to memory of 1796	688	360safe.exe	regsvr32.exe
PID 688 wrote to memory of 1796	688	360safe.exe	regsvr32.exe
PID 688 wrote to memory of 1796	688	360safe.exe	regsvr32.exe
PID 688 wrote to memory of 1796	688	360safe.exe	regsvr32.exe
PID 688 wrote to memory of 1796	688	360safe.exe	regsvr32.exe
PID 688 wrote to memory of 1796	688	360safe.exe	regsvr32.exe
PID 688 wrote to memory of 1796	688	360safe.exe	regsvr32.exe
PID 688 wrote to memory of 972	688	360safe.exe	zhudongfangyu.exe
PID 688 wrote to memory of 972	688	360safe.exe	zhudongfangyu.exe
PID 688 wrote to memory of 972	688	360safe.exe	zhudongfangyu.exe
PID 688 wrote to memory of 972	688	360safe.exe	zhudongfangyu.exe
PID 1212 wrote to memory of 1120	1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe	360se.exe
PID 1212 wrote to memory of 1120	1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe	360se.exe
PID 1212 wrote to memory of 1120	1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe	360se.exe
PID 1212 wrote to memory of 1120	1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe	360se.exe
PID 1212 wrote to memory of 1120	1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe	360se.exe
PID 1212 wrote to memory of 1120	1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe	360se.exe
PID 1212 wrote to memory of 1120	1212	a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe	360se.exe
PID 688 wrote to memory of 1476	688	360safe.exe	360tray.exe
PID 688 wrote to memory of 1476	688	360safe.exe	360tray.exe
PID 688 wrote to memory of 1476	688	360safe.exe	360tray.exe
PID 688 wrote to memory of 1476	688	360safe.exe	360tray.exe
PID 688 wrote to memory of 1056	688	360safe.exe	SoftupNotify.exe
PID 688 wrote to memory of 1056	688	360safe.exe	SoftupNotify.exe
PID 688 wrote to memory of 1056	688	360safe.exe	SoftupNotify.exe
PID 688 wrote to memory of 1056	688	360safe.exe	SoftupNotify.exe
PID 1120 wrote to memory of 1796	1120	360se.exe	bd_work.exe
PID 1120 wrote to memory of 1796	1120	360se.exe	bd_work.exe
PID 1120 wrote to memory of 1796	1120	360se.exe	bd_work.exe
PID 1120 wrote to memory of 1796	1120	360se.exe	bd_work.exe
PID 1120 wrote to memory of 1796	1120	360se.exe	bd_work.exe
PID 1120 wrote to memory of 1796	1120	360se.exe	bd_work.exe
PID 1120 wrote to memory of 1796	1120	360se.exe	bd_work.exe
PID 1796 wrote to memory of 1472	1796	bd_work.exe	360se_chs.exe
PID 1796 wrote to memory of 1472	1796	bd_work.exe	360se_chs.exe
PID 1796 wrote to memory of 1472	1796	bd_work.exe	360se_chs.exe
PID 1796 wrote to memory of 1472	1796	bd_work.exe	360se_chs.exe
PID 1796 wrote to memory of 1472	1796	bd_work.exe	360se_chs.exe
PID 1796 wrote to memory of 1472	1796	bd_work.exe	360se_chs.exe
PID 1796 wrote to memory of 1472	1796	bd_work.exe	360se_chs.exe
PID 1476 wrote to memory of 2056	1476	360tray.exe	SoftMgrProxy64.exe
PID 1476 wrote to memory of 2056	1476	360tray.exe	SoftMgrProxy64.exe
PID 1476 wrote to memory of 2056	1476	360tray.exe	SoftMgrProxy64.exe
PID 1476 wrote to memory of 2056	1476	360tray.exe	SoftMgrProxy64.exe
PID 1472 wrote to memory of 2444	1472	360se_chs.exe	seup.exe

C:\Users\Admin\AppData\Local\Temp\a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe
"C:\Users\Admin\AppData\Local\Temp\a58576116c631a49cbc281b6e20671fa0c765eb4395f3237185d7eebdcad279d.exe"
1⤵
- Loads dropped DLL
- Checks for any installed AV software in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1212

C:\Users\Admin\AppData\Local\Temp\360safe.exe
"C:\Users\Admin\AppData\Local\Temp\360safe.exe" /S /D=C:\Program Files (x86)\360\360Safe
2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Registers COM server for autorun
- Sets service image path in registry
- Loads dropped DLL
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:688

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\360\360Safe\Utils\shell360ext64.dll"
3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:1796

C:\Program Files (x86)\360\360Safe\deepscan\zhudongfangyu.exe
"C:\Program Files (x86)\360\360Safe\deepscan\zhudongfangyu.exe" /InstallAndStart
3⤵
- Executes dropped EXE
- Sets service image path in registry
PID:972

C:\Program Files (x86)\360\360Safe\safemon\360tray.exe
"C:\Program Files (x86)\360\360Safe\safemon\360tray.exe" /TrayInstall
3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Sets service image path in registry
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476

C:\Program Files (x86)\360\360Safe\SoftMgr\SoftMgrProxy64.exe
"C:\Program Files (x86)\360\360Safe\SoftMgr\SoftMgrProxy64.exe" /64BITTASKBAR=hook
4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2056

C:\Program Files (x86)\360\360Safe\SoftMgr\SoftupNotify.exe
"C:\Program Files (x86)\360\360Safe\SoftMgr\SoftupNotify.exe" /install
3⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies Control Panel
- Modifies registry class
PID:1056

C:\Users\Admin\AppData\Local\Temp\360box_3.0.0.1010.exe
"C:\Users\Admin\AppData\Local\Temp\360box_3.0.0.1010.exe" /S /D=C:\Program Files (x86)\360\360SafeBox
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1320

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.360.cn/down/soft_down9_x64.html
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:824

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:824 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1004

C:\Users\Admin\AppData\Local\Temp\360se.exe
"C:\Users\Admin\AppData\Local\Temp\360se.exe" /S /D=C:\Program Files (x86)\360\360Se
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1120

C:\Users\Admin\AppData\Local\Temp\360se_chs\bd_work.exe
C:\Users\Admin\AppData\Local\Temp\360se_chs\bd_work.exe
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1796

C:\Users\Admin\AppData\Local\Temp\360se_chs\360se_chs.exe
"C:\Users\Admin\AppData\Local\Temp\360se_chs\360se_chs.exe" /NA /pid=menghuanxy /homepage=http://xyq.163.com/ /NW /S
4⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1472

C:\Users\Admin\AppData\Roaming\360se\bin\seup.exe
"C:\Users\Admin\AppData\Roaming\360se\bin\seup.exe" -install
5⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:2444

C:\Users\Admin\AppData\Roaming\360se\bin\360se.exe
"C:\Users\Admin\AppData\Roaming\360se\bin\360se.exe" /tp:16 /v:5 /ipid:1472 /ifinish:688 /idisp:504
5⤵
- Executes dropped EXE
PID:2456

C:\Users\Admin\AppData\Local\Temp\360se_chs\360se_chs.exe
"C:\Users\Admin\AppData\Local\Temp\360se_chs\360se_chs.exe" /post=http://seapp.stat.360safe.com/q.html?name=suannai&server=5.0.8.1&appver=0&mid=018b6ce608df02ce8778f3808357703e&c=1_1_1_0_0_0_0
5⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:2488

C:\Program Files (x86)\360\360Safe\safemon\360tray.exe
"C:\Program Files (x86)\360\360Safe\safemon\360tray.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2656

C:\Program Files (x86)\360\360Safe\deepscan\zhudongfangyu.exe
"C:\Program Files (x86)\360\360Safe\deepscan\zhudongfangyu.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Sets service image path in registry
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:868

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Browser Extensions

T1176

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Security Software Discovery

T1063

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\360\360Safe\Utils\shell360ext64.dll
Filesize
258KB

MD5
0ef03821c12618545f7c4b656c52f50e

SHA1
9cc767051f366ffaec4ef73129f1b0039c550f9b

SHA256
0186194746a107a37561529d92f832267aac2a4f36e3915998ab8276a305b75b

SHA512
6dba835811b580d039699a311e9151d7015e356735e307835d6bf4f9e4147dca8b4151190613d0e46eeb5836ec1ef52b3aa9976fd1bbb3f7732e660a235771a9

Download Submit
C:\Program Files (x86)\360\360Safe\deepscan\360FsFlt.sys
Filesize
347KB

MD5
6e0da019256070ffe27151af3171eab7

SHA1
78d38d028df3270f320e433a2b88c35b63f51fbf

SHA256
d4fd30713b2b307938bb622b6e5021dd23582e9bb158eadb0f4f0532d888560c

SHA512
4195312e6d82420f80a795c43a7ca3a24a92ee04a8b97be9f76441c0a7fff9bb818a6961b326336cab414eb0f06ba268b1d5b25f887d845aa42f56518a30b725

Download Submit
C:\Program Files (x86)\360\360Safe\deepscan\360MalwareSection.dll
Filesize
332KB

MD5
9cce2eea1f6adbf54f6fe227f86006c4

SHA1
ac7f07df5d73477b710c756af9ba561cafdd103b

SHA256
9e430a1cae47638e3b8d31b35b8e1292907e048a7009fe1bbf0c83d20a6dff65

SHA512
bbabaaba8adac086be2a855159a392966715bbd5e580648401bced96f7e7c17dcda60f7c751b8fbd052f87a70523ec91f2b46e7c98fa76f1a3a664f8c984f693

Download Submit
C:\Program Files (x86)\360\360Safe\deepscan\360netcfg.exe
Filesize
257KB

MD5
68fd969f07e52068a9a3bf324141e70f

SHA1
3c7f00c9e63808b9ba1bceb622226a0276bb85a6

SHA256
521a9190c053b402ab8d36366271a3768f016f9ab8fc903911939191442bee00

SHA512
bc9c672d8a2ff364f8ceefc9b7e89df98e2844d921ee77c4a295233b3e18f68f88dbaf817f41c53c6263898df019e6edbba13e1ecffe087ae931440eae9a1365

Download Submit
C:\Program Files (x86)\360\360Safe\deepscan\APKCheck.dll
Filesize
182KB

MD5
808671c4174e9f0c8023adf2d6b1509e

SHA1
97aea98e0bb6ec9bd32500344fec8f82164eb6e3

SHA256
33237117862577f7f9684aedb4a4cdf9fa9aea31ba50ff8bfb8b1227f3faeb6a

SHA512
c10504d6c70830f2011737cf2276734bcc3bf7be495b52e15343db0ebd4513657094c09d0d5fe62254bff594d705d478597de98ffc117796b30b32f117451192

Download Submit
C:\Program Files (x86)\360\360Safe\deepscan\BAPI.dll
Filesize
181KB

MD5
10a6c6211d28a6788abcc05f146e1736

SHA1
4a568049cb73e157bd4a5a83b464da52a5cc80dc

SHA256
bf4a89cf5a5b42095a10949ee5db2222dcf650e8af6fad7f538b99cab72175e7

SHA512
a99bb6470892f39b386949bcb29bb798609abaf2167cdd09cdd9b610758ad8fe3f199606c98a6f803ec98f7e7eeaec2e223c20cf78cd87ef9bff3bf8785d8bef

Download Submit
C:\Program Files (x86)\360\360Safe\deepscan\BAPIDRV.sys
Filesize
137KB

MD5
3c28d1f31addd6c12e2de9d3a955a1b5

SHA1
7fa77dc90ca137fb31f2a211f02ddede0aea37cf

SHA256
ecf0434f37d2ae8b8efd57c2e22fbe86ec685dc3fff9ca0d43d403a25633d111

SHA512
052d3204dae2b63ad6e713f6a2099b07266be5df8734bb3035b24b51a773a98e1def6a3188242ca4e5870557567a6bc85dc28c010af3ff90dcf1fbd6087d976e

Download Submit
C:\Program Files (x86)\360\360Safe\deepscan\BAPIDRV64.sys
Filesize
167KB

MD5
5d01fbedd13d8d31396701a6fd0042a3

SHA1
43cc14edc0f379a944b646327108cf6da535b0b1

SHA256
9d768c7ba7337b526b6e32a022f3cc474220a861516fbe7ce5227d040b5f8fee

SHA512
b100206ef86b8ef847f9c2353b5bb5659635d2bd6d48ffe2b23ef7891f9d5bdd683783745955a17e51d9388741eabe02f70a53cff919ea80a26d1884f8463908

Download Submit
C:\Program Files (x86)\360\360Safe\deepscan\CloudEngine.dll
Filesize
569KB

MD5
7777dc6681671eb67f8350f43b7afd3c

SHA1
8cc9f00df51f81e97dbb564a04e4357567ae0ce0

SHA256
dcfde4b81eed33415e4d4742d4254820e2987733e30c9002124ead656dcd84c0

SHA512
f240246e61855ee7316c4878f3aec4cac2768a7bbd5377a5910700316d42d476b587b7e4b9b668b38956b3589e17f1adc18d7a4eecad51c6602483943314d2b0

Download Submit
C:\Program Files (x86)\360\360Safe\deepscan\ZhuDongFangYu.exe
Filesize
271KB

MD5
3258e387644b0f298c2cc070c4d133ad

SHA1
696572b52d45a8b8ac17135d1f9df3112b2c5534

SHA256
3b7ef527dcc70ed8a17beeaf022912d4711e6135a0ac7b954df7ad72b2f3a2eb

SHA512
a4d329657b4cb504e180d146fd806ec97a01558a8ddc85b5f8011b48e9a0d5ea23dc169ce4aa8a7cf56504d3b4716d70caa0dbcc1d0e3a73cc1e9c68263f2be0

Download Submit
C:\Program Files (x86)\360\360Safe\deepscan\art.dat
Filesize
10KB

MD5
bab4e1f053b69ffc20e62c382d2ced55

SHA1
43db33c8769a7d16cfbbc93a836aed5f84ce1b5c

SHA256
dbf1e28d8cc4da8697b5c78b445d969e6d996e96c119063830afdd6a319d553c

SHA512
af70171e9bb87f39910089e894d2b9ab808407c16249c5a9b1ab868761854ed80759da13c1439381bbc8997a07320b67328fe49d873d21a0ead1c904b627c7a9

Download Submit
C:\Program Files (x86)\360\360Safe\deepscan\ave\360ave.def
Filesize
207KB

MD5
5fdba34dbd10725c6da5c2ae282f8936

SHA1
799ad0104a4e86eda72b83775b6778e23b6b2e4a

SHA256
58beeac1ec312cd4fcbe92c0853e6d101aba35aa9d68a335d8f1a8dc320eff4d

SHA512
ad224265f9f502e3246aaef68ffb299cfc039c8f190d58e0e0a8bff55ebab4c60a35c0c9ba7030f7a87bf9a11a561b2f91ffcd0cc30992fb437c1868ffb76999

Download Submit
C:\Program Files (x86)\360\360Safe\deepscan\ave\AVEI.dll
Filesize
231KB

MD5
e56f68abc402af19ab1349e3ba31c185

SHA1
38821981bd79f9ddeb3da36af6aa8101ca1c8ea2

SHA256
bfcdf2f7c2797c3f2a51107720796f6dbff620892f2c40e5341c1cc40f60ea12

SHA512
21d25fc75684d09895ac4ea1b26f01ff76d5a7573a866e635bfb9b489296123b1505b63bc874923098c9754ce2eafa43e7768c579333762d47fe8ae2d5acae12

Download Submit
C:\Program Files (x86)\360\360Safe\deepscan\ave\AVEngine.dll
Filesize
717KB

MD5
ae976e6a75b00347fe43db56ebff1967

SHA1
5a339750579be83d45171f2f6fc89838afde66f3

SHA256
8f9ac92207eced25cabf347ea3e526489e38601b7d5b22d0eba1329ec73a21a7

SHA512
86b0e4fee509f2bbe378742dedd55de3afb9c964b5911d27d190ae03aa86a45c6685e85df81bbfa8f7ce48801a36ad44068b7ac69d83559ac2dcf3ea483565c5

Download Submit
C:\Program Files (x86)\360\360Safe\deepscan\cloudcom2.dll
Filesize
775KB

MD5
b97e206b762c782b219fafa3a7c8be97

SHA1
20e6e2e97bf88e8e27dbd907be4e60a598228eda

SHA256
71be45e00e4fe9c9f78a032a1cb500d82a872b7ce2dd2c7fbde3a30a7126aee3

SHA512
826ace0678c12e89e787e6be70d951811ea75ec40f86bafc0ffdd3e2c61bb1be1d787312c2f311ffc8c21ba686d2a7faf48f6c655a1f0bc6ecd5deab212eefaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\360box_3.0.0.1010.exe
Filesize
4.0MB

MD5
eebbe0e0f749fd17585180ff484600ea

SHA1
c505dbae76ccc9ff2cc7d9e53acea7ec347b08a9

SHA256
4c64a01fc43a0d1b3a4df9ef3cb9b783f07f7702c5848466349636dd97d3140d

SHA512
e88f7537d22843c49aa76fcef1f05dd150c40029844b61c74a2d01c5f1f874cb1a383b0febaec80ec843dfc63b1a14f029df6f3d129a01f1eb3b2d111bf93e97

Download Submit
C:\Users\Admin\AppData\Local\Temp\360box_3.0.0.1010.exe
Filesize
4.0MB

MD5
eebbe0e0f749fd17585180ff484600ea

SHA1
c505dbae76ccc9ff2cc7d9e53acea7ec347b08a9

SHA256
4c64a01fc43a0d1b3a4df9ef3cb9b783f07f7702c5848466349636dd97d3140d

SHA512
e88f7537d22843c49aa76fcef1f05dd150c40029844b61c74a2d01c5f1f874cb1a383b0febaec80ec843dfc63b1a14f029df6f3d129a01f1eb3b2d111bf93e97

Download Submit
C:\Users\Admin\AppData\Local\Temp\360safe.exe
Filesize
35.6MB

MD5
57add446729db7e63b1246fef9114d93

SHA1
6e005fe862124dd9102f78d6447edbca762b25d6

SHA256
8b62e8db3369d948a1636e93c7a6741b3f9e4c416265ec7d697968d60bd7fdae

SHA512
c10e1ced8265e973493627d0440ef7d638b3132bc7d040db64ef52bd1e573cc481672be7d4513c6d09e5986c485e487d435bc3782914d4b62765f99a447a865d

Download Submit
C:\Users\Admin\AppData\Local\Temp\360safe.exe
Filesize
35.6MB

MD5
57add446729db7e63b1246fef9114d93

SHA1
6e005fe862124dd9102f78d6447edbca762b25d6

SHA256
8b62e8db3369d948a1636e93c7a6741b3f9e4c416265ec7d697968d60bd7fdae

SHA512
c10e1ced8265e973493627d0440ef7d638b3132bc7d040db64ef52bd1e573cc481672be7d4513c6d09e5986c485e487d435bc3782914d4b62765f99a447a865d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\EBBGMVB2.txt
Filesize
293B

MD5
0da7ad57258f84f13ce876462c762f06

SHA1
a8870bf3139bf2e309fb93d3aaf70a83322e14ff

SHA256
82e2b827e2bc5befd3541465a0aa24a0bee1cb1e45f209c946d9bc39e8447041

SHA512
6ffe3734f7907bb3faa1dcbb0992295e95874ea4c0bc9ac30f424028f61e531d3baa5b12ea65f2b4f60d869cc1284764e60f12b4f6d92f896616169ec6498491

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\GPCKG4UO.txt
Filesize
398B

MD5
c7303ee61f776ff7af1a3c862c712d6c

SHA1
cce0c6cb789d35253d43b5784df2aa35a00d9f32

SHA256
20aefd9d18463e38503d2e24e8df4b2dfb54f7a7e0d2e0c8e2dd6202024673fa

SHA512
8db8eaa0be79d1d2491e878f40ba4da089147271b80d1fb95552b080571986a00f134d9b3858abf227138707ae4eb70499122f102a78eae16e852cfade77448e

Download Submit
\Program Files (x86)\360\360Safe\360Safe.exe
Filesize
1.2MB

MD5
e0f7b03599139c8474bd148a925aa990

SHA1
36931ab7a9140604aaad791bd3a3e279fd000802

SHA256
d75a4f904ad0ecea8c73ae599c26e02f3adcdb5ac4bcbb1a0362f157d95d2d7a

SHA512
6b64ecd4dd6b4cb0f760f0aac2b75a320ac77cc7f3260a2ddbd3308f2d4219602510803f7f840c227ffdc30116828e3898f5121641117d28f73cf98c0a619f28

Download Submit
\Program Files (x86)\360\360Safe\360Safe.exe
Filesize
1.2MB

MD5
e0f7b03599139c8474bd148a925aa990

SHA1
36931ab7a9140604aaad791bd3a3e279fd000802

SHA256
d75a4f904ad0ecea8c73ae599c26e02f3adcdb5ac4bcbb1a0362f157d95d2d7a

SHA512
6b64ecd4dd6b4cb0f760f0aac2b75a320ac77cc7f3260a2ddbd3308f2d4219602510803f7f840c227ffdc30116828e3898f5121641117d28f73cf98c0a619f28

Download Submit
\Program Files (x86)\360\360Safe\360Safe.exe
Filesize
1.2MB

MD5
e0f7b03599139c8474bd148a925aa990

SHA1
36931ab7a9140604aaad791bd3a3e279fd000802

SHA256
d75a4f904ad0ecea8c73ae599c26e02f3adcdb5ac4bcbb1a0362f157d95d2d7a

SHA512
6b64ecd4dd6b4cb0f760f0aac2b75a320ac77cc7f3260a2ddbd3308f2d4219602510803f7f840c227ffdc30116828e3898f5121641117d28f73cf98c0a619f28

Download Submit
\Program Files (x86)\360\360Safe\SoftMgr\360SpeedTime.dll
Filesize
128KB

MD5
7b2e10e7885598d396e461c39b46b976

SHA1
5e46b06d3318e8d227561145f75fca035798a5fd

SHA256
5af53df6b02b1d28f6fa937088c5ec5e4d2cd4a482b3f3836e9c97101e1311ec

SHA512
680e5dc63c76767d006c3b49f15181bf166d7615ea4337621f2ae94ddf378e6f5cb31975c85bc480efa984d73135a71a367b259372c20d622a3f92d37f5c5968

Download Submit
\Program Files (x86)\360\360Safe\SoftMgr\SoftManager.exe
Filesize
2.1MB

MD5
4e330b5d9864424c327c07952d60286b

SHA1
04def03fa4d1b4100176ff518059faa653f3e60f

SHA256
c459eae16e4e403f3112d14016ce9d7578b3095946c69ed8a7141b6136471838

SHA512
70d98530bc0e861c05066699081a08e810caa775eedee438a55b2980ac8b411adc826654e0f26f54672f5d12180e0d31db82552c7b0ae020a024cc141d07f2de

Download Submit
\Program Files (x86)\360\360Safe\SoftMgr\SoftManager.exe
Filesize
2.1MB

MD5
4e330b5d9864424c327c07952d60286b

SHA1
04def03fa4d1b4100176ff518059faa653f3e60f

SHA256
c459eae16e4e403f3112d14016ce9d7578b3095946c69ed8a7141b6136471838

SHA512
70d98530bc0e861c05066699081a08e810caa775eedee438a55b2980ac8b411adc826654e0f26f54672f5d12180e0d31db82552c7b0ae020a024cc141d07f2de

Download Submit
\Program Files (x86)\360\360Safe\SoftMgr\SoftManager.exe
Filesize
2.1MB

MD5
4e330b5d9864424c327c07952d60286b

SHA1
04def03fa4d1b4100176ff518059faa653f3e60f

SHA256
c459eae16e4e403f3112d14016ce9d7578b3095946c69ed8a7141b6136471838

SHA512
70d98530bc0e861c05066699081a08e810caa775eedee438a55b2980ac8b411adc826654e0f26f54672f5d12180e0d31db82552c7b0ae020a024cc141d07f2de

Download Submit
\Program Files (x86)\360\360Safe\Utils\shell360ext.dll
Filesize
223KB

MD5
db9109e3a74d99443ed2e11e5543d256

SHA1
a0980ef23142fdcecb4703e7508d41048b6dbdc3

SHA256
a5a21235b36652cf2a24aaefcf374dde982ee867de23a95ba4f244afae969114

SHA512
05db32581ccddfc0efcff1f284f35a95b4d5e5a69572734f5e056e69c57fd63def741f46c8b104aefc80f73fa9520483eee679810c0c2cca37128d99e66bb3a9

Download Submit
\Program Files (x86)\360\360Safe\Utils\shell360ext64.dll
Filesize
258KB

MD5
0ef03821c12618545f7c4b656c52f50e

SHA1
9cc767051f366ffaec4ef73129f1b0039c550f9b

SHA256
0186194746a107a37561529d92f832267aac2a4f36e3915998ab8276a305b75b

SHA512
6dba835811b580d039699a311e9151d7015e356735e307835d6bf4f9e4147dca8b4151190613d0e46eeb5836ec1ef52b3aa9976fd1bbb3f7732e660a235771a9

Download Submit
\Program Files (x86)\360\360Safe\deepscan\ZhuDongFangYu.exe
Filesize
271KB

MD5
3258e387644b0f298c2cc070c4d133ad

SHA1
696572b52d45a8b8ac17135d1f9df3112b2c5534

SHA256
3b7ef527dcc70ed8a17beeaf022912d4711e6135a0ac7b954df7ad72b2f3a2eb

SHA512
a4d329657b4cb504e180d146fd806ec97a01558a8ddc85b5f8011b48e9a0d5ea23dc169ce4aa8a7cf56504d3b4716d70caa0dbcc1d0e3a73cc1e9c68263f2be0

Download Submit
\Program Files (x86)\360\360Safe\deepscan\qutmload.dll
Filesize
69KB

MD5
42868c65b9f29e0dbcb5b41cb31c42fc

SHA1
0302646520826b9aab465becdc478f05da0107c4

SHA256
3d4a0254f2a5b61d2f14b65db79ce7a66412a361500952c0365c4923ae5e9080

SHA512
2fa3ace500c7077ede0e6e060be7bb79d1ced5bef321632145377a54806cea42410e96366c1b0c79f52a826b3ae19c871d6f777c9b8848f1314f38d993fc8c93

Download Submit
\Program Files (x86)\360\360Safe\ipc\360Box.dll
Filesize
39KB

MD5
f1e4cb3aadffac15a4043029dfb33fbb

SHA1
bb0cdc7819f2654b9f56c2d7496ba587d84e6860

SHA256
950081c6c91d4d290f23208ca1cb972524b0cfe64971dcafdfbf9bac5e5e11fc

SHA512
3f04e74d99451a6026cbee02aefffb9fb525760e52fd078c28fe5561b97836d2a4f69c43dc712232ac51f9bc46b2361d5b736576c60738008b087c75dbc84278

Download Submit
\Program Files (x86)\360\360Safe\ipc\DrvUtility.dll
Filesize
204KB

MD5
93a823bccc7251facd00215c01f34be6

SHA1
c6d9caaa650c5fe8eafc8f929a59ada08719b018

SHA256
038b67f984ba9427273ef7e9237b310c4380ec49babb48c29211ba6a78952a8d

SHA512
f8f8f1fce88f02b833cf0bbb73085832c33db59459da88a3e0ead33ce55106dfbd2eb54cf97a7a259829206cc3bb0b657415a33eb05db1f5f7cf3f9cadd416fd

Download Submit
\Program Files (x86)\360\360Safe\ipc\X64For32Lib.dll
Filesize
50KB

MD5
0c7e45e1beb3532c74be17b12725bfe6

SHA1
df59c0519105e0b30351b2ba824f383a602c8c49

SHA256
9700b215ea9f04cbb180eda8e719c1d3f4e8785f232eb344a03a57abb1a8c30d

SHA512
66a3e37d1318d8c4255ad8c555c7e350a7e5a584616f9c5dc8399dbec7ad7905f4404fbcf4f985a540bc7de9c0e59a70c4a1e94ac2d49bf553f953cf5d900607

Download Submit
\Program Files (x86)\360\360Safe\ipc\sbmon.dll
Filesize
171KB

MD5
169c8f6df3f50a4e935ea04420b70eec

SHA1
c623ccf15fa0e81b96c5db35964c810a04e9f769

SHA256
76986af285d4c3ed633c86637b007d29dc980fadda4781c61940d85cdd47f260

SHA512
23c94271915339a3821fdc2b96ada7efc214f93b02e79a95a1f8c93d1af39276d1ab93709e69c5bfc7332f6daa130ca680764bfb7e344a8b8abae5701f7f6231

Download Submit
\Program Files (x86)\360\360Safe\mobilemgr\SoftUpdateM.dll
Filesize
143KB

MD5
ff11db36f7f6e79412fb5c3bce43c859

SHA1
9a2f94e1f20b06fa6cbd0c60407a87641c3876a7

SHA256
6b0d45a6b0517496f2b0159d77946bdebd87db7cd9ce7ce809bf1d752731e954

SHA512
a56b32e5047879b58967bd11b043b9f44a62a109762dd7747cae0724ba7e2a21f2dc0e5ffa5be35ab102c8231db1c7db69ae3dd781dc5260c633bc3563fa9ae3

Download Submit
\Program Files (x86)\360\360Safe\mobilemgr\np360MMPlugIn.dll
Filesize
104KB

MD5
8afd9a0e1d6147bcb04b7aca58d36370

SHA1
16c26927965555369ecbbaa1cab491c06a5720d6

SHA256
026998ea6c1a0a427e53a412917f89a6a13db25996765cea8af3e0c00d918a5b

SHA512
1b85ec2218dbc6a21578113965a05ffbf03a5f6cf16239e857ddbe548ceae53e47cda154457380be0b417e4b69ad0a6ea1df4886a954736529e4942e1428a254

Download Submit
\Program Files (x86)\360\360Safe\netmon\360netctrl.dll
Filesize
352KB

MD5
51a9538fc1d30d6ab5de8068167d5309

SHA1
07a416c93e3b6e5e98737a6753f905da0867108b

SHA256
32590fbcf29671fcb9bb92ad612c6d6bf1157c5731afd85eec8b37d49e50284b

SHA512
0314c2f0e10b670e151f58dfa04999154885408e74ff1f3c1cf967ebd3a946364306b17351d96247f701e67347b12c33e7a8682c16c83495af53598d1905f4ab

Download Submit
\Program Files (x86)\360\360Safe\netmon\netmstart.dll
Filesize
124KB

MD5
81c3447c3f71302e10b150b5c23db30d

SHA1
719bc3a9d8b9b87f167a34621ddbd170d60e9ae3

SHA256
0bbe3a0473a55e699096fb89c6bcf3da1d178712260a99cdeb71640884a5b3e0

SHA512
29cd0e315e0263d15d0ed76ba768977b1aca563cf37d367577ca04277a0b525e76e193125f6792182c58d38ce82d4c6e99a7c4b69614b9e09086fe66b286ac88

Download Submit
\Program Files (x86)\360\360Safe\safemon\360procmon.dll
Filesize
445KB

MD5
1117d18eacebb56fb400a6cff1c99c71

SHA1
92d7775e008275f3df944fe7557d7d4f9530c403

SHA256
8425aee03f83b27b393e00fd8e0ca6ba8e865e9a9ef169b46777e5d67cc05dba

SHA512
1f98f5bcac3ffead61832325d336e9369cf080d11646aa7720ac92d29ad993b3c1cc54e9e776c1b5b69c0f4fecb99ca561adbe9110dc0439b0213c302c0f74ee

Download Submit
\Program Files (x86)\360\360Safe\safemon\360realpro.exe
Filesize
724KB

MD5
b3be89dbb4846275af868839c1ca2569

SHA1
901193f2f16bf1988e4a3dea45096aee63e3878a

SHA256
52d57fcdbc9d27dde9d0bf7a0026d11770ce03860523214d9a35d06b90c52713

SHA512
1037e8ed2417208c58c73bf37537b9fbec624018f1a825393e6258f765d5fe863a13aa6290f128a68b1f31342f9affe363a772d6c15b83c8ece9d48b7ed9b227

Download Submit
\Program Files (x86)\360\360Safe\safemon\safemon.dll
Filesize
618KB

MD5
ee19f4d06f8581c5c72762603a4e4442

SHA1
e4fe1b0816d3f02024afedc51ad5eadab6b9d9ed

SHA256
e34cb206297b71997bfbb39564f16f21aee87ed0822a1cd389c2f51b527a28e3

SHA512
ecc7db65851c989941489b62959bc153dd4d82744acbd624ba4ea623e1ec5eff21eddfc2377445e6fb2204622571a178f8c1677cfca595dd88faedb7fd864912

Download Submit
\Program Files (x86)\360\360Safe\uninst.exe
Filesize
1.1MB

MD5
7cea110a7a91987d1baf2b93fd2b4f07

SHA1
3ec6f6d5ea398578c6d13ad4226897b3479efcfa

SHA256
62506ff5233ffb6f12af5170532b0cb60df683aa9c7395c395cf7f97e026c326

SHA512
67a41f6191d6a7af3c2aff324414a9ed27241a44656dd2a0f27ff90aa954b340e5001f2fc7445315661599998552b3fe320979b49df0261da528c6516d06cddf

Download Submit
\Users\Admin\AppData\Local\Temp\360box_3.0.0.1010.exe
Filesize
4.0MB

MD5
eebbe0e0f749fd17585180ff484600ea

SHA1
c505dbae76ccc9ff2cc7d9e53acea7ec347b08a9

SHA256
4c64a01fc43a0d1b3a4df9ef3cb9b783f07f7702c5848466349636dd97d3140d

SHA512
e88f7537d22843c49aa76fcef1f05dd150c40029844b61c74a2d01c5f1f874cb1a383b0febaec80ec843dfc63b1a14f029df6f3d129a01f1eb3b2d111bf93e97

Download Submit
\Users\Admin\AppData\Local\Temp\360box_3.0.0.1010.exe
Filesize
4.0MB

MD5
eebbe0e0f749fd17585180ff484600ea

SHA1
c505dbae76ccc9ff2cc7d9e53acea7ec347b08a9

SHA256
4c64a01fc43a0d1b3a4df9ef3cb9b783f07f7702c5848466349636dd97d3140d

SHA512
e88f7537d22843c49aa76fcef1f05dd150c40029844b61c74a2d01c5f1f874cb1a383b0febaec80ec843dfc63b1a14f029df6f3d129a01f1eb3b2d111bf93e97

Download Submit
\Users\Admin\AppData\Local\Temp\360box_3.0.0.1010.exe
Filesize
4.0MB

MD5
eebbe0e0f749fd17585180ff484600ea

SHA1
c505dbae76ccc9ff2cc7d9e53acea7ec347b08a9

SHA256
4c64a01fc43a0d1b3a4df9ef3cb9b783f07f7702c5848466349636dd97d3140d

SHA512
e88f7537d22843c49aa76fcef1f05dd150c40029844b61c74a2d01c5f1f874cb1a383b0febaec80ec843dfc63b1a14f029df6f3d129a01f1eb3b2d111bf93e97

Download Submit
\Users\Admin\AppData\Local\Temp\360box_3.0.0.1010.exe
Filesize
4.0MB

MD5
eebbe0e0f749fd17585180ff484600ea

SHA1
c505dbae76ccc9ff2cc7d9e53acea7ec347b08a9

SHA256
4c64a01fc43a0d1b3a4df9ef3cb9b783f07f7702c5848466349636dd97d3140d

SHA512
e88f7537d22843c49aa76fcef1f05dd150c40029844b61c74a2d01c5f1f874cb1a383b0febaec80ec843dfc63b1a14f029df6f3d129a01f1eb3b2d111bf93e97

Download Submit
\Users\Admin\AppData\Local\Temp\360net_861.dll
Filesize
49KB

MD5
f6c560ecd7497fe57d1bd71c37b5b59d

SHA1
f87aee6d3163962484b4f95226c83df3e6150c3e

SHA256
4343e6d1223f6e50c1e953ecb77753bbc0211a6b2df397435172cfeee29d7e26

SHA512
ed61e63f98e88d6ba1285417c425cd7e8a5646cf9d03a5bb7b0171254eefa52409af34d2fbaffa3502b6a234e92ca904dce00ce8067ee37ab55b18aabd22951e

Download Submit
\Users\Admin\AppData\Local\Temp\360safe.exe
Filesize
35.6MB

MD5
57add446729db7e63b1246fef9114d93

SHA1
6e005fe862124dd9102f78d6447edbca762b25d6

SHA256
8b62e8db3369d948a1636e93c7a6741b3f9e4c416265ec7d697968d60bd7fdae

SHA512
c10e1ced8265e973493627d0440ef7d638b3132bc7d040db64ef52bd1e573cc481672be7d4513c6d09e5986c485e487d435bc3782914d4b62765f99a447a865d

Download Submit
\Users\Admin\AppData\Local\Temp\360safe.exe
Filesize
35.6MB

MD5
57add446729db7e63b1246fef9114d93

SHA1
6e005fe862124dd9102f78d6447edbca762b25d6

SHA256
8b62e8db3369d948a1636e93c7a6741b3f9e4c416265ec7d697968d60bd7fdae

SHA512
c10e1ced8265e973493627d0440ef7d638b3132bc7d040db64ef52bd1e573cc481672be7d4513c6d09e5986c485e487d435bc3782914d4b62765f99a447a865d

Download Submit
\Users\Admin\AppData\Local\Temp\360safe.exe
Filesize
35.6MB

MD5
57add446729db7e63b1246fef9114d93

SHA1
6e005fe862124dd9102f78d6447edbca762b25d6

SHA256
8b62e8db3369d948a1636e93c7a6741b3f9e4c416265ec7d697968d60bd7fdae

SHA512
c10e1ced8265e973493627d0440ef7d638b3132bc7d040db64ef52bd1e573cc481672be7d4513c6d09e5986c485e487d435bc3782914d4b62765f99a447a865d

Download Submit
\Users\Admin\AppData\Local\Temp\360safe.exe
Filesize
35.6MB

MD5
57add446729db7e63b1246fef9114d93

SHA1
6e005fe862124dd9102f78d6447edbca762b25d6

SHA256
8b62e8db3369d948a1636e93c7a6741b3f9e4c416265ec7d697968d60bd7fdae

SHA512
c10e1ced8265e973493627d0440ef7d638b3132bc7d040db64ef52bd1e573cc481672be7d4513c6d09e5986c485e487d435bc3782914d4b62765f99a447a865d

Download Submit
\Users\Admin\AppData\Local\Temp\nsoF23E.tmp\System.dll
Filesize
10KB

MD5
7d85b1f619a3023cc693a88f040826d2

SHA1
09f5d32f8143e7e0d9270430708db1b9fc8871a8

SHA256
dc198967b0fb2bc7aaab0886a700c7f4d8cb346c4f9d48b9b220487b0dfe8a18

SHA512
5465804c56d6251bf369609e1b44207b717228a8ac36c7992470b9daf4a231256c0ce95e0b027c4164e62d9656742a56e2b51e9347c8b17ab51ff40f32928c85

Download Submit
\Users\Admin\AppData\Local\Temp\nsoF23E.tmp\System.dll
Filesize
10KB

MD5
7d85b1f619a3023cc693a88f040826d2

SHA1
09f5d32f8143e7e0d9270430708db1b9fc8871a8

SHA256
dc198967b0fb2bc7aaab0886a700c7f4d8cb346c4f9d48b9b220487b0dfe8a18

SHA512
5465804c56d6251bf369609e1b44207b717228a8ac36c7992470b9daf4a231256c0ce95e0b027c4164e62d9656742a56e2b51e9347c8b17ab51ff40f32928c85

Download Submit
\Users\Admin\AppData\Local\Temp\nsoF23E.tmp\System.dll
Filesize
10KB

MD5
7d85b1f619a3023cc693a88f040826d2

SHA1
09f5d32f8143e7e0d9270430708db1b9fc8871a8

SHA256
dc198967b0fb2bc7aaab0886a700c7f4d8cb346c4f9d48b9b220487b0dfe8a18

SHA512
5465804c56d6251bf369609e1b44207b717228a8ac36c7992470b9daf4a231256c0ce95e0b027c4164e62d9656742a56e2b51e9347c8b17ab51ff40f32928c85

Download Submit
\Users\Admin\AppData\Local\Temp\nsoF23E.tmp\System.dll
Filesize
10KB

MD5
7d85b1f619a3023cc693a88f040826d2

SHA1
09f5d32f8143e7e0d9270430708db1b9fc8871a8

SHA256
dc198967b0fb2bc7aaab0886a700c7f4d8cb346c4f9d48b9b220487b0dfe8a18

SHA512
5465804c56d6251bf369609e1b44207b717228a8ac36c7992470b9daf4a231256c0ce95e0b027c4164e62d9656742a56e2b51e9347c8b17ab51ff40f32928c85

Download Submit
\Users\Admin\AppData\Local\Temp\nsoF23E.tmp\System.dll
Filesize
10KB

MD5
7d85b1f619a3023cc693a88f040826d2

SHA1
09f5d32f8143e7e0d9270430708db1b9fc8871a8

SHA256
dc198967b0fb2bc7aaab0886a700c7f4d8cb346c4f9d48b9b220487b0dfe8a18

SHA512
5465804c56d6251bf369609e1b44207b717228a8ac36c7992470b9daf4a231256c0ce95e0b027c4164e62d9656742a56e2b51e9347c8b17ab51ff40f32928c85

Download Submit
\Users\Admin\AppData\Local\Temp\nsoF23E.tmp\System.dll
Filesize
10KB

MD5
7d85b1f619a3023cc693a88f040826d2

SHA1
09f5d32f8143e7e0d9270430708db1b9fc8871a8

SHA256
dc198967b0fb2bc7aaab0886a700c7f4d8cb346c4f9d48b9b220487b0dfe8a18

SHA512
5465804c56d6251bf369609e1b44207b717228a8ac36c7992470b9daf4a231256c0ce95e0b027c4164e62d9656742a56e2b51e9347c8b17ab51ff40f32928c85

Download Submit
\Users\Admin\AppData\Local\Temp\nsoF23E.tmp\System.dll
Filesize
10KB

MD5
7d85b1f619a3023cc693a88f040826d2

SHA1
09f5d32f8143e7e0d9270430708db1b9fc8871a8

SHA256
dc198967b0fb2bc7aaab0886a700c7f4d8cb346c4f9d48b9b220487b0dfe8a18

SHA512
5465804c56d6251bf369609e1b44207b717228a8ac36c7992470b9daf4a231256c0ce95e0b027c4164e62d9656742a56e2b51e9347c8b17ab51ff40f32928c85

Download Submit
\Users\Admin\AppData\Local\Temp\nsoF23E.tmp\System.dll
Filesize
10KB

MD5
7d85b1f619a3023cc693a88f040826d2

SHA1
09f5d32f8143e7e0d9270430708db1b9fc8871a8

SHA256
dc198967b0fb2bc7aaab0886a700c7f4d8cb346c4f9d48b9b220487b0dfe8a18

SHA512
5465804c56d6251bf369609e1b44207b717228a8ac36c7992470b9daf4a231256c0ce95e0b027c4164e62d9656742a56e2b51e9347c8b17ab51ff40f32928c85

Download Submit
\Users\Admin\AppData\Local\Temp\nsoF23E.tmp\System.dll
Filesize
10KB

MD5
7d85b1f619a3023cc693a88f040826d2

SHA1
09f5d32f8143e7e0d9270430708db1b9fc8871a8

SHA256
dc198967b0fb2bc7aaab0886a700c7f4d8cb346c4f9d48b9b220487b0dfe8a18

SHA512
5465804c56d6251bf369609e1b44207b717228a8ac36c7992470b9daf4a231256c0ce95e0b027c4164e62d9656742a56e2b51e9347c8b17ab51ff40f32928c85

Download Submit
\Users\Admin\AppData\Local\Temp\{722413E9-D2E7-4ab2-9F39-25DB946CDB4E}.tmp
Filesize
1.1MB

MD5
4811e5dbb964efa2f306de9b1c41e8f3

SHA1
fdda95476c69e178372a212057f7d47372fc4b75

SHA256
c5fbac11182a88b59c290bc0930203f6b2f4ba687c8c475532e66e8d2f7a3876

SHA512
5db1ea88037d7984e34f04ccb5db8a47c16017292cff70b078b1f615a7c51a65953f6773914a4bbdf482513cd4be12641a3156d04db8c10713b39769c2a3c914

Download Submit
\Users\Admin\AppData\Local\Temp\{99F07D60-39EA-44d1-B94B-CA438E9E44BB}.tmp
Filesize
963KB

MD5
b793fc0c86ae02ac57ce89441071fe81

SHA1
0494bfcd53084f0b0bb1276daa79c1346c6620b8

SHA256
f165068503f41e6c275ae0a277793ed83490576ed99170d151ba2dab4a3ea401

SHA512
7d52e231ce5ff26ce846512c1eb5ae86d52d7366958f021a0a2f34198679db6f253dd92d5767aefa394ba665fa0c1629b58ce94f33a5bbdc21d982fe3aa2da5b

Download Submit
memory/688-62-0x0000000000000000-mapping.dmp

Download
memory/688-150-0x0000000003A20000-0x0000000003A85000-memory.dmp

Filesize
404KB

Download
memory/688-147-0x0000000003980000-0x00000000039B8000-memory.dmp

Filesize
224KB

Download
memory/868-144-0x0000000001260000-0x00000000012AB000-memory.dmp

Filesize
300KB

Download
memory/868-149-0x0000000001980000-0x00000000019FB000-memory.dmp

Filesize
492KB

Download
memory/972-127-0x0000000000000000-mapping.dmp

Download
memory/1056-159-0x0000000000000000-mapping.dmp

Download
memory/1120-153-0x0000000000000000-mapping.dmp

Download
memory/1212-240-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1212-56-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1212-57-0x0000000004230000-0x0000000004434000-memory.dmp

Filesize
2.0MB

Download
memory/1212-54-0x0000000076711000-0x0000000076713000-memory.dmp

Filesize
8KB

Download
memory/1320-74-0x0000000000000000-mapping.dmp

Download
memory/1472-198-0x0000000000000000-mapping.dmp

Download
memory/1476-183-0x00000000033B0000-0x00000000033C8000-memory.dmp

Filesize
96KB

Download
memory/1476-195-0x00000000035F0000-0x0000000003600000-memory.dmp

Filesize
64KB

Download
memory/1476-163-0x00000000021B0000-0x0000000002204000-memory.dmp

Filesize
336KB

Download
memory/1476-165-0x0000000002380000-0x00000000023C3000-memory.dmp

Filesize
268KB

Download
memory/1476-166-0x0000000002F10000-0x0000000002FA0000-memory.dmp

Filesize
576KB

Download
memory/1476-168-0x0000000002F75000-0x0000000002F86000-memory.dmp

Filesize
68KB

Download
memory/1476-169-0x00000000023C1000-0x00000000023E2000-memory.dmp

Filesize
132KB

Download
memory/1476-170-0x00000000023C0000-0x00000000023F3000-memory.dmp

Filesize
204KB

Download
memory/1476-173-0x00000000032B0000-0x0000000003323000-memory.dmp

Filesize
460KB

Download
memory/1476-177-0x0000000003330000-0x000000000335B000-memory.dmp

Filesize
172KB

Download
memory/1476-179-0x0000000003380000-0x00000000033AB000-memory.dmp

Filesize
172KB

Download
memory/1476-181-0x0000000003900000-0x00000000039E7000-memory.dmp

Filesize
924KB

Download
memory/1476-157-0x0000000000000000-mapping.dmp

Download
memory/1476-184-0x00000000033B1000-0x00000000033E6000-memory.dmp

Filesize
212KB

Download
memory/1476-185-0x00000000033B0000-0x00000000033FD000-memory.dmp

Filesize
308KB

Download
memory/1476-187-0x0000000003400000-0x0000000003443000-memory.dmp

Filesize
268KB

Download
memory/1476-219-0x0000000007440000-0x0000000007522000-memory.dmp

Filesize
904KB

Download
memory/1476-188-0x0000000003570000-0x00000000035B3000-memory.dmp

Filesize
268KB

Download
memory/1476-191-0x00000000036B0000-0x00000000036DB000-memory.dmp

Filesize
172KB

Download
memory/1476-161-0x0000000002160000-0x00000000021AC000-memory.dmp

Filesize
304KB

Download
memory/1476-196-0x0000000004A10000-0x0000000004B34000-memory.dmp

Filesize
1.1MB

Download
memory/1476-200-0x0000000004C70000-0x0000000004CCF000-memory.dmp

Filesize
380KB

Download
memory/1476-218-0x0000000006220000-0x0000000006238000-memory.dmp

Filesize
96KB

Download
memory/1476-202-0x0000000005040000-0x0000000005076000-memory.dmp

Filesize
216KB

Download
memory/1476-204-0x0000000004CF1000-0x0000000004CFD000-memory.dmp

Filesize
48KB

Download
memory/1476-205-0x0000000005210000-0x0000000005253000-memory.dmp

Filesize
268KB

Download
memory/1476-208-0x00000000065B0000-0x000000000662B000-memory.dmp

Filesize
492KB

Download
memory/1476-210-0x0000000006630000-0x00000000066F9000-memory.dmp

Filesize
804KB

Download
memory/1476-212-0x0000000006ED0000-0x0000000006EEA000-memory.dmp

Filesize
104KB

Download
memory/1476-214-0x00000000071A0000-0x00000000071FF000-memory.dmp

Filesize
380KB

Download
memory/1796-106-0x000007FEFC581000-0x000007FEFC583000-memory.dmp

Filesize
8KB

Download
memory/1796-186-0x0000000000000000-mapping.dmp

Download
memory/1796-105-0x0000000000000000-mapping.dmp

Download
memory/2056-213-0x0000000000000000-mapping.dmp

Download
memory/2444-230-0x0000000000000000-mapping.dmp

Download
memory/2456-231-0x0000000000000000-mapping.dmp

Download
memory/2488-235-0x0000000000000000-mapping.dmp

Download
memory/2656-238-0x0000000000000000-mapping.dmp

Download