Trojan.Siggen14.53303

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\360Box64] 'ImagePath' = '<DRIVERS>\360Box64.sys'
[<HKLM>\System\CurrentControlSet\Services\360Box64] 'ImagePath' = 'system32\DRIVERS\360Box64.sys'
[<HKLM>\System\CurrentControlSet\Services\360Box64] 'Start' = '00000001'
[<HKLM>\System\CurrentControlSet\Services\360Camera] 'ImagePath' = 'System32\Drivers\360Camera64.sys'
[<HKLM>\System\CurrentControlSet\Services\360AntiHacker] 'Start' = '00000001'
[<HKLM>\System\CurrentControlSet\Services\360AntiHacker] 'ImagePath' = 'System32\Drivers\360AntiHacker64.sys'
[<HKLM>\System\CurrentControlSet\Services\360AntiHijack] 'Start' = '00000001'
[<HKLM>\System\CurrentControlSet\Services\360AntiHijack] 'ImagePath' = 'System32\Drivers\360AntiHijack64.sys'
[<HKLM>\SYSTEM\CurrentControlSet\Services\ZhuDongFangYu] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\ZhuDongFangYu] 'ImagePath' = '"%ProgramFiles(x86)%\360\360safe\deepscan\zhudongfangyu.exe"'
[<HKLM>\System\CurrentControlSet\Services\360netmon] 'Start' = '00000001'
[<HKLM>\System\CurrentControlSet\Services\360netmon] 'ImagePath' = '<DRIVERS>\360netmon.sys'
[<HKLM>\System\CurrentControlSet\Services\360FsFlt] 'Start' = '00000001'
[<HKLM>\System\CurrentControlSet\Services\360FsFlt] 'ImagePath' = '<DRIVERS>\360FsFlt.sys'
[<HKLM>\System\CurrentControlSet\Services\360FsFlt] 'ImagePath' = 'system32\DRIVERS\360FsFlt.sys'
[<HKLM>\System\CurrentControlSet\Services\360netmon] 'ImagePath' = 'system32\DRIVERS\360netmon.sys'

Creates the following services

'360Box64' <DRIVERS>\360Box64.sys
'360Camera' System32\Drivers\360Camera64.sys
'360AntiHacker' System32\Drivers\360AntiHacker64.sys
'360AntiHijack' System32\Drivers\360AntiHijack64.sys
'ZhuDongFangYu' %ProgramFiles(x86)%\360\360safe\deepscan\zhudongfangyu.exe
'ZhuDongFangYu' "%ProgramFiles(x86)%\360\360safe\deepscan\zhudongfangyu.exe"
'360netmon' <DRIVERS>\360netmon.sys
'360FsFlt' <DRIVERS>\360FsFlt.sys

Malicious functions

Injects code into

the following system processes:

%WINDIR%\explorer.exe

Registers BHO

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}]
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}]

Registers file system filter

[<HKLM>\System\CurrentControlSet\Services\360Box64] 'Group' = 'FSFilter Activity Monitor'
[<HKLM>\System\CurrentControlSet\Services\360FsFlt] 'Group' = 'FSFilter Activity Monitor'

Modifies file system

Creates the following files

%TEMP%\nshc1f8.tmp
%ProgramFiles(x86)%\360\360safe\endata\aw_1029.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1030.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1032.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1033.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1026.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1034.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1028.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1036.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1039.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1040.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1042.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1043.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1035.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1024.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1037.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1027.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1025.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1023.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1007.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1008.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1010.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1012.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1015.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1016.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1017.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1018.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1019.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1020.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1021.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1022.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1044.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1003.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1045.dat
%ProgramFiles(x86)%\360\360safe\360diagnosescan.exe
%ProgramFiles(x86)%\360\360safe\endata\aw_1046.dat
%ProgramFiles(x86)%\360\360safe\endata\dg_18.dat
%ProgramFiles(x86)%\360\360safe\endata\dg_002.dat
%ProgramFiles(x86)%\360\360safe\endata\dg_24.dat
%ProgramFiles(x86)%\360\360safe\endata\dg_25.dat
%ProgramFiles(x86)%\360\360safe\endata\dg_26.dat
%ProgramFiles(x86)%\360\360safe\endata\dg_28.dat
%ProgramFiles(x86)%\360\360safe\endata\dg_29.dat
%ProgramFiles(x86)%\360\360safe\endata\dg_61.dat
%ProgramFiles(x86)%\360\360safe\endata\dg_82.dat
%ProgramFiles(x86)%\360\360safe\endata\dgcategory.dat
%ProgramFiles(x86)%\360\360safe\endata\dt_1.dat
%ProgramFiles(x86)%\360\360safe\endata\dt_2.dat
%ProgramFiles(x86)%\360\360safe\endata\dt_3.dat
%ProgramFiles(x86)%\360\360safe\endata\dt_4.dat
%ProgramFiles(x86)%\360\360safe\endata\h_1.dat
%ProgramFiles(x86)%\360\360safe\endata\dg_17.dat
%ProgramFiles(x86)%\360\360safe\endata\dg_146.dat
%ProgramFiles(x86)%\360\360safe\endata\dg_22.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1006.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1002.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1047.dat
%ProgramFiles(x86)%\360\360safe\endata\dg_003.dat
%ProgramFiles(x86)%\360\360safe\endata\dg_004.dat
%ProgramFiles(x86)%\360\360safe\endata\dg_005.dat
%ProgramFiles(x86)%\360\360safe\endata\dg_006.dat
%ProgramFiles(x86)%\360\360safe\endata\dg_007.dat
%ProgramFiles(x86)%\360\360safe\endata\dg_008.dat
%ProgramFiles(x86)%\360\360safe\endata\dg_009.dat
%ProgramFiles(x86)%\360\360safe\endata\dg_010.dat
%ProgramFiles(x86)%\360\360safe\endata\dg_011.dat
%ProgramFiles(x86)%\360\360safe\endata\dg_012.dat
%ProgramFiles(x86)%\360\360safe\endata\dg_013.dat
%ProgramFiles(x86)%\360\360safe\endata\dg_014.dat
%ProgramFiles(x86)%\360\360safe\endata\dg_015.dat
%ProgramFiles(x86)%\360\360safe\endata\dg_1001.dat
%ProgramFiles(x86)%\360\360safe\endata\dg_001.dat
%ProgramFiles(x86)%\360\360safe\endata\dg_016.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1004.dat
%ProgramFiles(x86)%\360\360safe\endata\aw_1001.dat
%ProgramFiles(x86)%\360\360safe\endata\aw2_1010.dat
%ProgramFiles(x86)%\360\360safe\ipc\filedef.dat
%ProgramFiles(x86)%\360\360safe\ipc\cpavescan.def
%ProgramFiles(x86)%\360\360safe\ipc\fa8fd2a5-743d-430b-90a8-051922c07b09.def
%ProgramFiles(x86)%\360\360safe\ipc\filedef.dll
%ProgramFiles(x86)%\360\360safe\ipc\appdext.dll
%ProgramFiles(x86)%\360\360safe\ipc\360ipc.dat
%ProgramFiles(x86)%\360\360safe\ipc\ts.dat
%ProgramFiles(x86)%\360\360safe\ipc\filter.dat
%ProgramFiles(x86)%\360\360safe\ipc\filter64.dat
%ProgramFiles(x86)%\360\360safe\ipc\appmon.dat
%ProgramFiles(x86)%\360\360safe\ipc\filemon.dat
%ProgramFiles(x86)%\360\360safe\ipc\regmon.dat
%ProgramFiles(x86)%\360\360safe\ipc\360antihacker64_win10.sys
%ProgramFiles(x86)%\360\360safe\ipc\drvutility.dll
%ProgramFiles(x86)%\360\360safe\endata\h_2.dat
%ProgramFiles(x86)%\360\360safe\ipc\clsid.dat
%ProgramFiles(x86)%\360\360safe\ipc\360netr.dat
%ProgramFiles(x86)%\360\360safe\ipc\netdefender.dll
%ProgramFiles(x86)%\360\360safe\ipc\360antihacker64.sys
%ProgramFiles(x86)%\360\360safe\ipc\sxin.dll
%ProgramFiles(x86)%\360\360safe\ipc\chkdrverr.dll
%ProgramFiles(x86)%\360\360safe\ipc\360box.dll
%ProgramFiles(x86)%\360\360safe\ipc\360boxmain.exe
%ProgramFiles(x86)%\360\360safe\ipc\dataprot.exe
%ProgramFiles(x86)%\360\360safe\ipc\360hvm64.sys
%ProgramFiles(x86)%\360\360safe\ipc\sbmon.dll
%ProgramFiles(x86)%\360\360safe\ipc\qutmipc.sys
%ProgramFiles(x86)%\360\360safe\ipc\qutmipc_win10.sys
%ProgramFiles(x86)%\360\360safe\ipc\yhregd.dll
%ProgramFiles(x86)%\360\360safe\ipc\ipcservice.dll
%ProgramFiles(x86)%\360\360safe\ipc\filemgr.dll
%ProgramFiles(x86)%\360\360safe\ipc\appd.dll
%ProgramFiles(x86)%\360\360safe\ipc\qutmipc.dll
%ProgramFiles(x86)%\360\360safe\ipc\x64for32lib.dll
%ProgramFiles(x86)%\360\360safe\ipc\appdef.dat
%ProgramFiles(x86)%\360\360safe\ipc\360hvm.dll
%ProgramFiles(x86)%\360\360safe\safemon\360.dat
%ProgramFiles(x86)%\360\360safe\antiarp\fixedwl.dat
%ProgramFiles(x86)%\360\360safe\libaw.dat
%ProgramFiles(x86)%\360\360safe\libdefa.dat
%ProgramFiles(x86)%\360\360safe\libvi.dat
%ProgramFiles(x86)%\360\360safe\libsdi.dat
%ProgramFiles(x86)%\360\360safe\softmgr\notifydown.dll
%ProgramFiles(x86)%\360\360safe\softmgr\softup.dat
%ProgramFiles(x86)%\360\360safe\endata\aw2_1001.dat
%ProgramFiles(x86)%\360\360safe\endata\aw2_1002.dat
%ProgramFiles(x86)%\360\360safe\endata\aw2_1004.dat
%ProgramFiles(x86)%\360\360safe\endata\aw2_1005.dat
%ProgramFiles(x86)%\360\360safe\endata\aw2_1006.dat
%ProgramFiles(x86)%\360\360safe\endata\aw2_1007.dat
%ProgramFiles(x86)%\360\360safe\endata\aw2_1008.dat
%ProgramFiles(x86)%\360\360safe\safemon\selfprotectapi2.dll
%ProgramFiles(x86)%\360\360safe\endata\aw2_1009.dat
%ProgramFiles(x86)%\360\360safe\antiadwa.dll
%ProgramFiles(x86)%\360\360safe\netmon\360arppopwnd.dll
%ProgramFiles(x86)%\360\360safe\netdiagdll.dll
%ProgramFiles(x86)%\360\360safe\dynlbase.dll
%ProgramFiles(x86)%\360\360safe\antiarp\360lanprotect.sys
%ProgramFiles(x86)%\360\360safe\antiarp\x64\360lanprotect_x64.inf
%ProgramFiles(x86)%\360\360safe\antiarp\x64\360lanprotect_x64.cat
%ProgramFiles(x86)%\360\360safe\antiarp\x64\360lanprotect_x64.sys
%ProgramFiles(x86)%\360\360safe\antiarp\x64\setuparpx64.exe
%ProgramFiles(x86)%\360\360safe\antiarp\dpath.ini
%ProgramFiles(x86)%\360\360safe\360restore.exe
%ProgramFiles(x86)%\360\360safe\360util.dll
%ProgramFiles(x86)%\360\360safe\360login.dll
%ProgramFiles(x86)%\360\360safe\360netul.dll
%ProgramFiles(x86)%\360\360safe\rpi.dat
%ProgramFiles(x86)%\360\360safe\360deskana.exe
%ProgramFiles(x86)%\360\360safe\360deskana64.exe
%ProgramFiles(x86)%\360\360safe\explorerext64.dll
%ProgramFiles(x86)%\360\360safe\ipc\360netd.dat
%ProgramFiles(x86)%\360\360safe\dynlenv.dll
%ProgramFiles(x86)%\360\360safe\ipc\360hvm64_win10.sys
%ProgramFiles(x86)%\360\360safe\endata\h_3.dat
%ProgramFiles(x86)%\360\360safe\deepscan\dsgs.dat
%ProgramFiles(x86)%\360\360safe\config\promote\icon.png
%ProgramFiles(x86)%\360\360safe\config\promote\img_speedopt_default.png
%ProgramFiles(x86)%\360\360safe\config\promote\lists.xml
%ProgramFiles(x86)%\360\360safe\config\promote\popularize_chasha.xml
%ProgramFiles(x86)%\360\360safe\config\promote\popularize_chasha_new.xml
%ProgramFiles(x86)%\360\360safe\config\promote\home_shouji.png
%ProgramFiles(x86)%\360\360safe\config\promote\home_worldcup_huodong.png
%ProgramFiles(x86)%\360\360safe\config\promote\popularize_chasha_risk.xml
%ProgramFiles(x86)%\360\360safe\config\promote\popularize_simplenews.xml
%ProgramFiles(x86)%\360\360safe\config\promote\popularize_speed.xml
%ProgramFiles(x86)%\360\360safe\config\promote\popularize_speed_new.xml
%ProgramFiles(x86)%\360\360safe\config\promote\popularize_tijian.xml
%ProgramFiles(x86)%\360\360safe\config\promote\popularize_tijian_new.xml
%ProgramFiles(x86)%\360\360safe\config\promote\popularize_safeclean.xml
%ProgramFiles(x86)%\360\360safe\config\promote\popularize_safeclean_new.xml
%ProgramFiles(x86)%\360\360safe\config\promote\home_protect.png
%ProgramFiles(x86)%\360\360safe\config\promote\broadcastbg.png
%ProgramFiles(x86)%\360\360safe\config\promote\popularize_xiufu_new.xml
%ProgramFiles(x86)%\360\360safe\config\promote\360kuaizixun_big_safeclean.png
%ProgramFiles(x86)%\360\360safe\config\promote\360kuandaicesu_speed.png
%ProgramFiles(x86)%\360\360safe\config\promote\360renwuguanli_speed.png
%ProgramFiles(x86)%\360\360safe\config\promote\360se_big.png
%ProgramFiles(x86)%\360\360safe\config\promote\360se_big_safeclean.png
%ProgramFiles(x86)%\360\360safe\config\promote\360shangwangzhushou_big_tijian.png
%ProgramFiles(x86)%\360\360safe\config\promote\360wentifankui_speed.png
%ProgramFiles(x86)%\360\360safe\config\promote\360winrebackup_big_tijian.png
%ProgramFiles(x86)%\360\360safe\config\promote\360yijianshangwang_speed.png
%ProgramFiles(x86)%\360\360safe\config\promote\buttonpromote_big.png
%ProgramFiles(x86)%\360\360safe\config\promote\largefile_safeclean.png
%ProgramFiles(x86)%\360\360safe\config\promote\popwndtracker_chasha.png
%ProgramFiles(x86)%\360\360safe\config\promote\v13_resultbtn.png
%ProgramFiles(x86)%\360\360safe\config\promote\popularize_xiufu.xml
%ProgramFiles(x86)%\360\360safe\config\promote\360diannaoqingli_speed.png
%ProgramFiles(x86)%\360\360safe\config\promote\home_huodong.png
%ProgramFiles(x86)%\360\360safe\config\promote\360xitongjijiuxiang_xiufu.png
%ProgramFiles(x86)%\360\360safe\config\promote\popularize_xiufu_v13.xml
%ProgramFiles(x86)%\360\360safe\efiproc.dll
%ProgramFiles(x86)%\360\360safe\efimon.sys
<DRIVERS>\360fsflt.sys
%WINDIR%\temp\udd3b8a.tmp
%WINDIR%\temp\udd3e68.tmp
%WINDIR%\temp\udd3fff.tmp
%WINDIR%\temp\udd40cb.tmp
%ProgramFiles(x86)%\360\360safe\softmgr\softmgr.db-journal
%ProgramFiles(x86)%\360\360safe\softmgr\softmgr.db
%ProgramFiles(x86)%\360\360safe\softmgr\somextrainfo.ini
%ProgramFiles(x86)%\360\360safe\ipc\filecache\filecache.dat.log1
%ProgramFiles(x86)%\360\360safe\ipc\filecache\filecache.dat
%APPDATA%\360safe\loginfo\new360_tmp_1628031427_3024.log2
%APPDATA%\360safe\loginfo\new360_tmp_1628031428_3024.log2
%ProgramFiles(x86)%\360\360safe\ipc\monstate.dat
<DRIVERS>\360antihijack64.sys
%ProgramFiles(x86)%\360\360safe\config\promote\360desktoplite_big_speed.png
%ProgramFiles(x86)%\360\360safe\config\promote\360jiasuqiu_speed.png
<DRIVERS>\360camera64.sys
%ProgramFiles(x86)%\360\360safe\config\promote\shouwei_big_xiufu.png
%ProgramFiles(x86)%\360\360safe\config\promote\speedoptbkframe.png
%ProgramFiles(x86)%\360\360safe\config\promote\v13_resultitembk.png
%ProgramFiles(x86)%\360\360safe\config\promote\v13_resultline.png
%ProgramFiles(x86)%\360\360safe\config\promote\v13_result_deficon.png
%ProgramFiles(x86)%\360\360safe\config\promote\result\resultadconfig.xml
%ProgramFiles(x86)%\360\360safe\config\promote\safemon\popwnd_bdsoft.png
%ProgramFiles(x86)%\360\360safe\config\promote\safemon\popwnd_trojan.png
%ProgramFiles(x86)%\360\360safe\config\promote\safemon\popwnd_unknown.png
%ProgramFiles(x86)%\360\360safe\uninst.exe
%ProgramFiles(x86)%\360\360safe\safemon\param.ini
%APPDATA%\360safe\userdata\rightmenusetting.ini
<DRIVERS>\360box64.sys
C:\360sandbox\360sandbox.sav.log1
C:\360sandbox\360sandbox.sav
%WINDIR%\temp\udd27fa.tmp
%ProgramFiles(x86)%\360\360safe\config\promote\shouwei_big_chasha.png
%ProgramFiles(x86)%\360\360safe\config\promote\360desktoplite_big_safeclean.png
%ProgramFiles(x86)%\360\360safe\config\promote\360sysclean_safeclean.png
%ProgramFiles(x86)%\360\360safe\safemon\360sctblist.exe
%ProgramFiles(x86)%\360\360safe\deepscan\avecfg.dat
%ProgramFiles(x86)%\360\360safe\deepscan\ave\avei.dll
%ProgramFiles(x86)%\360\360safe\deepscan\ave\avengine.dll
%ProgramFiles(x86)%\360\360safe\deepscan\ave\360ave_ex.def
%ProgramFiles(x86)%\360\360safe\deepscan\ave\plave.def
%ProgramFiles(x86)%\360\360safe\deepscan\qex\qex.dll
%ProgramFiles(x86)%\360\360safe\deepscan\qex\macrodef.enc
%ProgramFiles(x86)%\360\360safe\deepscan\qex\qex.vdb.enc
%ProgramFiles(x86)%\360\360safe\deepscan\qex\patt.enc
%ProgramFiles(x86)%\360\360safe\safemon\drvmk.dat
%ProgramFiles(x86)%\360\360safe\utils\360expert.dll
%ProgramFiles(x86)%\360\360safe\utils\siteuiproxy.dll
%ProgramFiles(x86)%\360\360safe\utils\recovery360.exe
%ProgramFiles(x86)%\360\360safe\deepscan\360fsflt_win10.sys
%ProgramFiles(x86)%\360\360safe\deepscan\360fsflt.sys
%ProgramFiles(x86)%\360\360safe\deepscan\avescan.dll
%ProgramFiles(x86)%\360\360safe\deepscan\zhudongfangyu.exe
%ProgramFiles(x86)%\360\360safe\utils\moduleupdate.exe
%ProgramFiles(x86)%\360\360safe\safemon\skin\browserfix\browserfixskin9_1.ui
%ProgramFiles(x86)%\360\360safe\deepscan\cpr.dat
%ProgramFiles(x86)%\360\360safe\deepscan\wpz.dat
%ProgramFiles(x86)%\360\360safe\deepscan\360netcfg.exe
%ProgramFiles(x86)%\360\360safe\deepscan\diageng.dll
%ProgramFiles(x86)%\360\360safe\deepscan\jcloudscan.dll
%ProgramFiles(x86)%\360\360safe\deepscan\qutmload.dll
%ProgramFiles(x86)%\360\360safe\deepscan\qutmdrv.sys
%ProgramFiles(x86)%\360\360safe\deepscan\qutmdrv_win10.sys
%ProgramFiles(x86)%\360\360safe\deepscan\dsark.dll
%ProgramFiles(x86)%\360\360safe\deepscan\dsark.sys
%ProgramFiles(x86)%\360\360safe\deepscan\dsark64.sys
%ProgramFiles(x86)%\360\360safe\deepscan\dsark_win10.sys
%ProgramFiles(x86)%\360\360safe\deepscan\dsark64_win10.sys
%ProgramFiles(x86)%\360\360safe\deepscan\dsark64_win10.cat
%ProgramFiles(x86)%\360\360safe\deepscan\ssr2.dat
%ProgramFiles(x86)%\360\360safe\deepscan\dsark_win10.cat
%ProgramFiles(x86)%\360\360safe\safemon\skin\browserfix2\browserfixskin2.ui
%ProgramFiles(x86)%\360\360safe\utils\360udiskcheck.exe
%ProgramFiles(x86)%\360\360safe\utils\360himmu.exe
%ProgramFiles(x86)%\360\360safe\config\filesmash.xml
%ProgramFiles(x86)%\360\360safe\config\defaultskin\defaultskin.ui
%ProgramFiles(x86)%\360\360safe\config\defaultskin\miniui.xml
%ProgramFiles(x86)%\360\360safe\config\promote\360cse_speed.png
%ProgramFiles(x86)%\360\360safe\config\promote\360drvmgr_tijian.png
%ProgramFiles(x86)%\360\360safe\config\promote\360jishi_xiufu.png
%ProgramFiles(x86)%\360\360safe\config\promote\360mainpagerepair_tijian.png
%ProgramFiles(x86)%\360\360safe\config\promote\360netrepair_xiufu.png
%ProgramFiles(x86)%\360\360safe\config\promote\360se_chasha.png
%ProgramFiles(x86)%\360\360safe\config\promote\360se_clean.png
%ProgramFiles(x86)%\360\360safe\config\promote\360se_speed.png
%ProgramFiles(x86)%\360\360safe\config\promote\360se_tijian.png
%ProgramFiles(x86)%\360\360safe\config\promote\360se_xiufu.png
%ProgramFiles(x86)%\360\360safe\netmon\360netrepair.exe
%ProgramFiles(x86)%\360\360safe\netmon\360netdr.dll
%ProgramFiles(x86)%\360\360safe\config\restoreconfig.xml
%ProgramFiles(x86)%\360\360safe\config\config.xml
%ProgramFiles(x86)%\360\360safe\utils\360screencapture.exe
%ProgramFiles(x86)%\360\360safe\utils\filesmasher.exe
%ProgramFiles(x86)%\360\360safe\utils\pluginmgr.dll
%ProgramFiles(x86)%\360\360safe\utils\immutip_config.dat
%ProgramFiles(x86)%\360\360safe\utils\360expclient.dll
%ProgramFiles(x86)%\360\360safe\utils\360expdata.dll
%ProgramFiles(x86)%\360\360safe\utils\360explogin.dll
%ProgramFiles(x86)%\360\360safe\utils\360uhelper.exe
%ProgramFiles(x86)%\360\360safe\utils\360feedback.exe
%ProgramFiles(x86)%\360\360safe\utils\360feedback.xml
%ProgramFiles(x86)%\360\360safe\utils\360protect.dll
%ProgramFiles(x86)%\360\360safe\utils\immplugin\hackpatch.dll
%ProgramFiles(x86)%\360\360safe\netmon\360taskmgr.exe
%ProgramFiles(x86)%\360\360safe\netmon\sysoptm.dll
%ProgramFiles(x86)%\360\360safe\netmon\sysmon.dll
%ProgramFiles(x86)%\360\360safe\netmon\360netdiag.dll
%ProgramFiles(x86)%\360\360safe\utils\powersaver.exe
%ProgramFiles(x86)%\360\360safe\netmon\360taskmgr.ini
%ProgramFiles(x86)%\360\360safe\ipc\360camera64_win10.sys
%ProgramFiles(x86)%\360\360safe\ipc\360camera64.sys
%ProgramFiles(x86)%\360\360safe\ipc\sxwrapper.dll
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360ncsom\360ncsom_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360netrepair\360netrepair_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360netmskin\360netmskin_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360newsorder\360newsorder_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360feedback12\360feedback12_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360newspop\360newspop_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360logcenter\360logcenter_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360realpro12\360realpro12_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360safeguide\skin_config.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360skinview\360skinview_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360softprivmgr\360softprivmgr_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360trayexit\360trayexit_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360realpro\360realpro_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360feedback\360feedback_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360safeguide\360safeguide.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360extauthen\360extauthen_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_newsreader.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360unionrestore\360unionrestore_theme12.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_sharemodule.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_skinview.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_speedupopt3.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_systemfix.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_trayexit.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_traymenu.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_zerop.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360appcustomer\360appcustomer_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360cleanhelper\360cleanhelper_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360diagnosescan\360diagnosescan_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360downloadfilemgr\360downloadfilemgr_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360entmgrswitcher\360entmgrswitcher.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360udiskpro\360udiskpro_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360unionrestore\360unionrestore_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_plugincleaner.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360evtmgr\360evtmgr_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\popwndtracker\pw_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360xpfix\360xpfix_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360ys\360ys_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\admgr\pwlog_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\advtool\advtool_theme.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\cleanrepair\cleanrepair_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\cleansoft\cleansoft_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\desktoprest\desktoprest.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\devicepro\devicepro_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\gamemaster\360gamemaster11a.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\immunity\immunity_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\mainframe\image\ico_mobilemgr.png
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\networkpenetratepro\networkpenetratepro_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\newsreader\newsreader_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\okclean\okcleannew12_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\photomanager\photomanager_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360settingcenter\360settingcenter_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_logcenter.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360safeloginandreg\360safelogandreg_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_safemenu.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360defaultsoft\360defaultsoft_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360funpre\360funpre_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360funpre\funpreconfig.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360funpre\t012288ded84aabcdc3.png
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360funpre\t013e8e89a564592167.png
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360funpre\t01566b4fff8a4eaac0.png
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360funpre\t0176f365288c58b5ae.png
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360funpre\t017adee4de9b1dcd73.png
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360funpre\t01be98863d13ae164c.png
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360funpre\t01cf9b1ecb1aa208fe.png
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360funpre\t01f58912b369abc91a.png
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360hipspopwnd\common\button_close.png
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360hipspopwnd\common\button_normal.png
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360hipspopwnd\common\window_shadow.png
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360hipspopwnd\popwnds\360hipspopwnd.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360qhstore\360qhstore_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_cleansoft.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360uhelper\360uhelper_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_checkautorun.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_center.xml
%ProgramFiles(x86)%\360\360safe\config\newui\compatible\defaultskin\defaultskin_jr.ui
%ProgramFiles(x86)%\360\360safe\config\newui\compatible\modules\360qandaexpert.exe\png\360qandaexpert.exe_png_140
%ProgramFiles(x86)%\360\360safe\config\newui\compatible\modules\360qandaexpert.exe\png\360qandaexpert.exe_png_144
%ProgramFiles(x86)%\360\360safe\config\newui\compatible\modules\360udetail.dll\png\360udetail.dll_png_206
%ProgramFiles(x86)%\360\360safe\config\newui\compatible\modules\360boxmain.exe\png\360boxmain.exe_png_184
%ProgramFiles(x86)%\360\360safe\config\newui\compatible\modules\dsmainui.dll\png\dsmainui.dll_png_2249
%ProgramFiles(x86)%\360\360safe\config\newui\compatible\modules\moduleupdate.exe\png\moduleupdate.exe_png_202
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360appcustomer_theme.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360hipspopwnd_theme.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\examineuiconfig10.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\default_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\defaultsoft_theme.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\desktoprest_theme.xml
%ProgramFiles(x86)%\360\360safe\config\newui\compatible\defaultskin\miniui.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\payinsure_theme.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\plugincleaner\plugincleaner_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\compatible\modules\360msgcenter.exe\png\360msgcenter.exe_png_229
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\realpro12_theme.xml
%ProgramFiles(x86)%\360\360safe\modules\360patchmgr64.exe
%TEMP%\nsxc209.tmp\system.dll
%ProgramFiles(x86)%\360\360safe\updatecfg_new.ini
%ProgramFiles(x86)%\360\360safe\360verify.dll
%ProgramFiles(x86)%\360\360safe\miniui.dll
%ProgramFiles(x86)%\360\360safe\libredlist.dat
%ProgramFiles(x86)%\360\360safe\updatecfg.ini
%ProgramFiles(x86)%\360\360safe\browserconfigfileinfo.dat
%TEMP%\nsxc209.tmp\nsplugin.dll
%ProgramFiles(x86)%\360\360safe\360safe.exe
%ProgramFiles(x86)%\360\360safe\360hotfix.exe
%ProgramFiles(x86)%\360\360safe\leakrepair.dll
%ProgramFiles(x86)%\360\360safe\utils\360sysrepairui.dll
%ProgramFiles(x86)%\360\360safe\config\logcentercfg.xml
%ProgramFiles(x86)%\360\360safe\safemon\360logcenter.exe
%ProgramFiles(x86)%\360\360safe\modules\360patchmgr.exe
%ProgramFiles(x86)%\360\360safe\hipsver.dll
%ProgramFiles(x86)%\360\360safe\safemon\hipslogcenter.dll
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360payinsure\360payinsure_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\skin.jpg
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_360evtmgr.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_360unionrestore12.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_360ys.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_cleanrepair.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_devicepro.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_immunity.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_okcleannew12.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_pdown.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_photomanager.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_safecheck.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_speedldolympic.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_speedldskin.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_sysrepair.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_uninstspeedup.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_360diagnosescan.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_360cleanhelper.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_360unionrestore.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_360entmgrswitcher.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\realpro_theme.xml
%ProgramFiles(x86)%\360\360safe\config\newui\compatible\modules\360login.dll\png\360login.dll_png_230
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_360extauthen.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_360feedback.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_360feedback12.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_360funpre.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_360gamemaster.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_360ia.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_360ncsom.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_360netrepair.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_360newsorder.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_360newspop.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_360qhstore.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_360safeloginandreg.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_360softprivmgr.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_360uhelper.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\theme_360udiskpro.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\360ia\360ia_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\popwndtracker\newui\360pw_theme.ui
%ProgramFiles(x86)%\360\360safe\netmon\360gmblack2.dat
%ProgramFiles(x86)%\360\360safe\safemon\netm.tpi
%ProgramFiles(x86)%\360\360safe\safemon\360tray.exe
%ProgramFiles(x86)%\360\360safe\safemon\360hipspopwnd.dll
%ProgramFiles(x86)%\360\360safe\safemon\360realpro.exe
%ProgramFiles(x86)%\360\360safe\safemon\360procmon.dll
%ProgramFiles(x86)%\360\360safe\safemon\360compro.dll
%ProgramFiles(x86)%\360\360safe\safemon\somproxy.dll
%ProgramFiles(x86)%\360\360safe\safemon\safemonhlp.dll
%ProgramFiles(x86)%\360\360safe\safemon\360udiskguard.exe
%ProgramFiles(x86)%\360\360safe\safemon\360udiskguard.dll
%ProgramFiles(x86)%\360\360safe\safemon\udiskscanengine.dll
%ProgramFiles(x86)%\360\360safe\safemon\udiskscan.dat
%ProgramFiles(x86)%\360\360safe\safemon\ruleconfig.bin
%ProgramFiles(x86)%\360\360safe\netmon\gameidentify.dat
%ProgramFiles(x86)%\360\360safe\netmon\360gameidentify.dll
%ProgramFiles(x86)%\360\360safe\safemon\netmon.tpi
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\protectarea\payinsureresex.xml
%ProgramFiles(x86)%\360\360safe\safemon\safehmpg.dll
%ProgramFiles(x86)%\360\360safe\safemon\sdadblock.tpi
%ProgramFiles(x86)%\360\360safe\360conf.dll
%ProgramFiles(x86)%\360\360safe\360netbase.dll
%ProgramFiles(x86)%\360\360safe\360restore.dll
%ProgramFiles(x86)%\360\360safe\netmon\config\netman\netman.ui
%ProgramFiles(x86)%\360\360safe\netmon\skin\default.uil
%ProgramFiles(x86)%\360\360safe\netmon\360netmon.ini
%ProgramFiles(x86)%\360\360safe\netmon\360gmps.dat
%ProgramFiles(x86)%\360\360safe\netmon\3gidentify.dll
%ProgramFiles(x86)%\360\360safe\netmon\360arpui.dll
%ProgramFiles(x86)%\360\360safe\netmon\360arpinstdrv.dll
%ProgramFiles(x86)%\360\360safe\netmon\360netman.exe
%ProgramFiles(x86)%\360\360safe\netmon\360netctrl.dll
%ProgramFiles(x86)%\360\360safe\netmon\netmstart.dll
%ProgramFiles(x86)%\360\360safe\netmon\netmonep.dll
%ProgramFiles(x86)%\360\360safe\360common.dll
%ProgramFiles(x86)%\360\360safe\netmon\netgm.dll
%ProgramFiles(x86)%\360\360safe\360base.dll
%ProgramFiles(x86)%\360\360safe\safemon\360traylogin.tpi
%ProgramFiles(x86)%\360\360safe\safemon\360antihijack.sys
%ProgramFiles(x86)%\360\360safe\safemon\360drwht.dat
%ProgramFiles(x86)%\360\360safe\safemon\drvms.dat
%ProgramFiles(x86)%\360\360safe\safemon\wd.ini
%ProgramFiles(x86)%\360\360safe\safemon\drvmon.dat
%ProgramFiles(x86)%\360\360safe\safemon\acls.ini
%ProgramFiles(x86)%\360\360safe\ipc\skin\360sandbox\360sandbox.ui
%ProgramFiles(x86)%\360\360safe\ipc\kmconfig.dat
%ProgramFiles(x86)%\360\360safe\ipc\cleancfg.dat
%ProgramFiles(x86)%\360\360safe\360shellpro.exe
%ProgramFiles(x86)%\360\360safe\ipc\360box64.sys
%ProgramFiles(x86)%\360\360safe\ipc\360box64_win10.sys
%ProgramFiles(x86)%\360\360safe\ipc\360boxld64.exe
%ProgramFiles(x86)%\360\360safe\ipc\sxin64.dll
%ProgramFiles(x86)%\360\360safe\safemon\360bsmon.tpi
%ProgramFiles(x86)%\360\360safe\safemon\360webpro.dll
%ProgramFiles(x86)%\360\360safe\safemon\360toasts.exe
%ProgramFiles(x86)%\360\360safe\safemon\360sptool.exe
%ProgramFiles(x86)%\360\360safe\safemon\diagscantips.tpi
%ProgramFiles(x86)%\360\360safe\safemon\360antihijack.dat
%ProgramFiles(x86)%\360\360safe\safemon\360antihijack_win10.sys
%ProgramFiles(x86)%\360\360safe\safemon\360antihijack64.sys
%ProgramFiles(x86)%\360\360safe\safemon\360antihijack64_win10.sys
%ProgramFiles(x86)%\360\360safe\safemon\360guardbase64.dll
%ProgramFiles(x86)%\360\360safe\safemon\360udiskguard64.dll
%ProgramFiles(x86)%\360\360safe\safemon\somproxy64.dll
%ProgramFiles(x86)%\360\360safe\safemon\360compro64.dll
%ProgramFiles(x86)%\360\360safe\safemon\safemon64.dll
%ProgramFiles(x86)%\360\360safe\safemon\safewrapper.dll
%ProgramFiles(x86)%\360\360safe\safemon\spsafe64.dll
%ProgramFiles(x86)%\360\360safe\safemon\safehmpg64.dll
%ProgramFiles(x86)%\360\360safe\safemon\safewrapper32.dll
%ProgramFiles(x86)%\360\360safe\safemon\spsafe.dll
%ProgramFiles(x86)%\360\360safe\safemon\psconfig.dat
%ProgramFiles(x86)%\360\360safe\safemon\360antihijack.tpi
%ProgramFiles(x86)%\360\360safe\safemon\preset_s.dat
<DRIVERS>\360antihacker64.sys
%ProgramFiles(x86)%\360\360safe\safemon\nhplib.dat
%ProgramFiles(x86)%\360\360safe\config\advtools\advancetools_pic_filesmash_10_32.png
%ProgramFiles(x86)%\360\360safe\softmgr\360elam.sys
%ProgramFiles(x86)%\360\360safe\softmgr\eainsthelper.exe
%ProgramFiles(x86)%\360\360safe\softmgr\360elam64.sys
%ProgramFiles(x86)%\360\360safe\softmgr\eainsthelper64.exe
%ProgramFiles(x86)%\360\360safe\softmgr\stsuglist.dat
%ProgramFiles(x86)%\360\360safe\safemon\safemon.dll
%ProgramFiles(x86)%\360\360safe\safemon\urlproc.dll
%ProgramFiles(x86)%\360\360safe\safemon\360safemonpro.tpi
%ProgramFiles(x86)%\360\360safe\safemon\360safecamera.tpi
%ProgramFiles(x86)%\360\360safe\safemon\dlproc.dll
%ProgramFiles(x86)%\360\360safe\safemon\wdrecord.dll
%ProgramFiles(x86)%\360\360safe\safemon\wdui2.dll
%ProgramFiles(x86)%\360\360safe\safemon\wdui3.dll
%ProgramFiles(x86)%\360\360safe\sweeper\syssweepernew.dat
%ProgramFiles(x86)%\360\360safe\sites.dll
%ProgramFiles(x86)%\360\360safe\softmgr\somadvutils.dll
%ProgramFiles(x86)%\360\360safe\config\advtools\dataprot.png
%ProgramFiles(x86)%\360\360safe\safemon\wdpaypro.exe
%ProgramFiles(x86)%\360\360safe\config\newui\themes\skinconfig.xml
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\sysrepair13\sysrepair13_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\systemfix\systemfix_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\uninstspeedup\uninstspeedup_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\checkautorun\checkautorun_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\common_font\font_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\pdown\pdown_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\safecheck\safecheck_theme12.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\safeidx\safeid_new_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\sharemodule\sharemodule_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\speedldolympic\speedldolympic_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\speedldskin\speedldskin_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\speedupoptv12\speedupopt12_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\sysrepair12\sysrepair12_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\zeropmgr\zeropmgr_theme.ui
%ProgramFiles(x86)%\360\360safe\config\newui\themes\default\safeidproxy\safeid_proxy_theme.ui
%ProgramFiles(x86)%\360\360safe\sweeper\syssweeper.dll
%ProgramFiles(x86)%\360\360safe\safemon\cameraprotect\cameraguard\bkg\pic_01.jpg
%ProgramFiles(x86)%\360\360safe\safemon\wdsafedown.exe
%ProgramFiles(x86)%\360\360safe\safemon\inetsafe.dll
%ProgramFiles(x86)%\360\360safe\safemon\360payinsure.exe
%ProgramFiles(x86)%\360\360safe\softmgr\defaultsoftset.exe
%ProgramFiles(x86)%\360\360safe\softmgr\lockkrnl.dll
%ProgramFiles(x86)%\360\360safe\softmgr\fileassocx.dat
%ProgramFiles(x86)%\360\360safe\utils\360msguiconfig.sign
%ProgramFiles(x86)%\360\360safe\config\360settingcenter.xml
%ProgramFiles(x86)%\360\360safe\config\advtools\360himmu.xml
%ProgramFiles(x86)%\360\360safe\config\advtools\defaultsoftsetting.xml
%ProgramFiles(x86)%\360\360safe\config\advtools\advancetools_defaultsoftsetting_10_32.png
%ProgramFiles(x86)%\360\360safe\config\advtools\advancetools_defaultsoftsetting_10_52.png
%ProgramFiles(x86)%\360\360safe\config\advtools\advancetools_360himmu_10_32.png
%ProgramFiles(x86)%\360\360safe\config\advtools\advancetools_360netrepair_10_32.png
%ProgramFiles(x86)%\360\360safe\config\advtools\360firstad_10_32.png
%ProgramFiles(x86)%\360\360safe\config\advtools\advancetools_360sandbox_10_32.png
%ProgramFiles(x86)%\360\360safe\safemon\7z.dll
%ProgramFiles(x86)%\360\360safe\safemon\settingcentercfg.dll
%ProgramFiles(x86)%\360\360safe\safemon\360zipc.dll
%ProgramFiles(x86)%\360\360safe\safemon\360settingcenter.exe
%ProgramFiles(x86)%\360\360safe\softmgr\somkernl.dll
%ProgramFiles(x86)%\360\360safe\safemon\browserfix.dll
%ProgramFiles(x86)%\360\360safe\safemon\360baobiao.exe
%ProgramFiles(x86)%\360\360safe\safemon\360guardbase.dll
%ProgramFiles(x86)%\360\360safe\safemon\360dfsopt.tpi
%ProgramFiles(x86)%\360\360safe\safemon\wdhpfilesafe.dll
%ProgramFiles(x86)%\360\360safe\safemon\wdswfsafe.exe
%ProgramFiles(x86)%\360\360safe\safemon\svcmonitor.dll
%ProgramFiles(x86)%\360\360safe\safemon\hkswf.dat
%ProgramFiles(x86)%\360\360safe\safemon\wdcnf.dat
%ProgramFiles(x86)%\360\360safe\safemon\wduicfg.dat
%ProgramFiles(x86)%\360\360safe\safemon\urllib.dat
%ProgramFiles(x86)%\360\360safe\safemon\urllibw.dat
%ProgramFiles(x86)%\360\360safe\safemon\urllibauth.dat
%ProgramFiles(x86)%\360\360safe\safemon\jsfeature.dat
%ProgramFiles(x86)%\360\360safe\safemon\images\toasts_waring.png
%ProgramFiles(x86)%\360\360safe\safemon\360sclog.exe
%ProgramFiles(x86)%\360\360safe\safemon\360login.dat

Deletes the following files

%ProgramFiles(x86)%\360\360safe\updatecfg_new.ini
%WINDIR%\temp\udd27fa.tmp
%WINDIR%\temp\udd3b8a.tmp
%WINDIR%\temp\udd3e68.tmp
%WINDIR%\temp\udd3fff.tmp
%WINDIR%\temp\udd40cb.tmp
%TEMP%\nsxc209.tmp\nsplugin.dll
%TEMP%\nsxc209.tmp\system.dll
%ProgramFiles(x86)%\360\360safe\softmgr\softmgr.db-journal

Network activity

Connects to

'co##.wsm.360.cn':80
's.#.360.cn':80
's.#.360.cn':443
'c.#.360.cn':80

TCP

HTTP POST requests

http://co##.wsm.360.cn/client/query2?&m####################################################

UDP

DNS ASK co##.wsm.360.cn
DNS ASK s.#.360.cn
DNS ASK u.###l.f.360.cn
DNS ASK c.#.360.cn
's.#.360.cn':53
'u.###l.f.360.cn':53

Miscellaneous

Adds a root certificate

Searches for the following windows

ClassName: '360Down' WindowName: ''
ClassName: 'Q360NetmonClassTips' WindowName: 'WndFastOptmTips2'
ClassName: 'Q360NetmonClassTips' WindowName: 'WndFastOptmTips'
ClassName: 'Q360NetmonClassHideTip' WindowName: ''
ClassName: '360NetmonWindowClass{364B97E2-D014-4e2f-88C7-482B040F0D31}' WindowName: ''
ClassName: 'Q360SafeMonClass' WindowName: ''
ClassName: 'Q360SafeMainClass' WindowName: ''
ClassName: 'Q360UDiskIdentity' WindowName: ''
ClassName: 'Q360BoxMain' WindowName: ''
ClassName: 'Q360GuardMain' WindowName: ''
ClassName: 'Q360DiagnoseScanClass' WindowName: ''
ClassName: 'Q360FunPre' WindowName: ''
ClassName: 'Q360NetOptimizeClass' WindowName: ''
ClassName: 'Q360SafeMainQmZDClass' WindowName: ''
ClassName: '360LeakFixer' WindowName: ''
ClassName: 'Q360WDClass' WindowName: ''
ClassName: '360SysSweeper' WindowName: ''
ClassName: 'Q360FWMainClass' WindowName: ''
ClassName: '360AntiarpClass' WindowName: ''
ClassName: '360DSMainClass' WindowName: ''
ClassName: '360DeepScanClass' WindowName: ''
ClassName: '360SoftManagerClass' WindowName: ''
ClassName: '360RepairLeakClass' WindowName: ''
ClassName: 'LiveUpdate360' WindowName: ''
ClassName: 'Q360NetmonMainWndClass' WindowName: ''
ClassName: 'Q360SDClass' WindowName: ''

Creates and executes the following

'%ProgramFiles(x86)%\360\360safe\utils\powersaver.exe' /flightsigning
'%ProgramFiles(x86)%\360\360safe\softmgr\eainsthelper64.exe' /Install
'%ProgramFiles(x86)%\360\360safe\deepscan\zhudongfangyu.exe' /Install
'%ProgramFiles(x86)%\360\360safe\deepscan\zhudongfangyu.exe' /start
'%ProgramFiles(x86)%\360\360safe\deepscan\zhudongfangyu.exe'
'%ProgramFiles(x86)%\360\360safe\safemon\360tray.exe' /hidetray

Executes the following

'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\360\360safe\safemon\safemon64.dll"
'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\360\360safe\safemon\safemon64.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\360\360safe\safemon\safemon.dll"

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial