Trojan.Siggen12.2622

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '360DrvMgr' = '"%ProgramFiles(x86)%\360\360DrvMgr\360DrvMgr.exe" -BootStartTempMonitor'

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\ComputerZ_x64] 'ImagePath' = '%TEMP%\_SFX_SX_4562CXJ\360DrvMgr\ComputerZ_x64.sys'
[<HKLM>\System\CurrentControlSet\Services\Drv_Mgr_Service] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\Drv_Mgr_Service] 'ImagePath' = '<SYSTEM32>\svchost.exe -k Drv_Mgr_Service'
[<HKLM>\SYSTEM\CurrentControlSet\Services\Drv_Mgr_Service\Parameters] 'ServiceDll' = '%ProgramFiles(x86)%\360\360DrvMgr\DrvMgrService.dll'
[<HKLM>\System\CurrentControlSet\Services\360Sensor_DM] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\360Sensor_DM] 'ImagePath' = '<DRIVERS>\360Sensor_DM64.sys'

Creates the following services

'ComputerZ_x64' %TEMP%\_SFX_SX_4562CXJ\360DrvMgr\ComputerZ_x64.sys
'Drv_Mgr_Service' <SYSTEM32>\svchost.exe -k Drv_Mgr_Service
'360Sensor_DM' <DRIVERS>\360Sensor_DM64.sys

Modifies file system

Creates the following files

%TEMP%\_sfx_sx_4562cxj\360drvmgr\computerz.set
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\computerz5.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\computerz2.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\computerz1.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\cloudcom2.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\atiags32.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\7za.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\netmon\360sensor.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\360p2sp.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\360netul.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\360netbase.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\360net.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\endata\h_3.dat
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\360common.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\uninst.exe
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\scriptexecute.exe
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\liveupdate360.exe
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\inst_drvmgr.exe
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\installtmdb64.exe
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\installtmdb.exe
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\feedback\drvmgrfeedback.exe
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\drvinst64.exe
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\computerzservice.exe
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\feedback\360screencapture.exe
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\360drvmgr.exe
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\360base.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\config\defaultskin\defaultskin.ui
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\computerz_hardwaredll.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\sqlite3.dll
%ProgramFiles(x86)%\360\360drvmgr\config\skin\tools\tool_1008.png
<DRIVERS>\360sensor_dm64.sys
C:\users\public\desktop\360驱动大师.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\360安全中心\360驱动大师\360驱动大师.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\360安全中心\360驱动大师\卸载360驱动大师.lnk
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\computerz_x64.sys
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\computerz.sys
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\netmon\360sensordrv\360sensor_dm64.sys
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\netmon\360sensordrv\360sensor_dm.sys
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\tmdeskband64.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\tmdeskband.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\difxapi_x86.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\datamgr.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\signhelper.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\safelive.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\pdown.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\miniui.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\liveupd360.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\dynlenv.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\dynlbase.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\drvmgrui.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\drvmgrservice.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\drvmgrcore.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\downloadmgr.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\tempmonitor.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\endata\h_2.dat
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\endata\h_1.dat
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\cacert.dat
%TEMP%\_sfx_sx_4562cxj\360drvmgr\drvinst64.exe
%TEMP%\_sfx_sx_4562cxj\360drvmgr\downloadmgr.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\computerz_x64.sys
%TEMP%\_sfx_sx_4562cxj\360drvmgr\computerz_mini.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\computerz_hardwaredll.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\computerzservice.exe
%TEMP%\_sfx_sx_4562cxj\360drvmgr\computerz5.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\computerz4.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\computerz2.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\computerz1.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\drvmgrui.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\computerz0.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\atiags32.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\360p2sp.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\360netbase.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\360net.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\360drvmgr.exe
%TEMP%\_sfx_sx_4562cxj\360drvmgr\360common.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\360base.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\normal.dat
%TEMP%\_sfx_sx_4562cxj\360drvmgr\config\defaultskin\miniui.xml
%TEMP%\_sfx_sx_4562cxj\360drvmgr\config\defaultskin\defaultskin.ui
%TEMP%\_sfx_sx_4562cxj\360drvmgr\config\config.xml
%TEMP%\_sfx_sx_4562cxj\360drvmgr\computerz.sys
%TEMP%\_sfx_sx_4562cxj\360drvmgr\dynlenv.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\drvmgrcore.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\liveupd360.dll
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\360libdrvmgr.dat
%APPDATA%\360drvmgr\360drvmgr_plugin_update\360drvmgrupd.ini
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\config\defaultskin\miniui.xml
%TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\config\config.xml
%TEMP%\{b6cd5934-0e63-4907-8244-5e9011f50c09}.tmp
%TEMP%\{05cf31ab-0c51-48bd-9ace-537e43c7d279}.tmp\7z.dll
%TEMP%\{c9438009-0048-4ffe-8629-1cecbdd83b96}.tmp
%TEMP%\_sfx_sx_4562cxj\360drvmgr\updatecache.dat
%APPDATA%\360drvmgr\updatecfg.ini
%APPDATA%\360drvmgr\360drvmgr_plugin_update\360drvmgrinstaller_beta.exe
%TEMP%\_sfx_sx_4562cxj\360drvmgr\hwparams.dat
%APPDATA%\360drvmgr\360drvmgr_plugin_update\~ee16.cab.p2p
%APPDATA%\360drvmgr\360drvmgr_plugin_update\~ee16.cab.mem
%WINDIR%\temp\udde225.tmp
%TEMP%\_sfx_sx_4562cxj\360drvmgr\miniui.dll
%APPDATA%\360drvmgr\360drvmgr_plugin_update\~8861.cab.~p2s
%TEMP%\_sfx_sx_4562cxj\360drvmgr\computerz.dat
%APPDATA%\360safe\liveupdatelog\360net_360drvmgr.log
%APPDATA%\360safe\liveupdatelog\p2sp_360drvmgr.log
%APPDATA%\360safe\liveupdatelog\360drvmgr.log
%WINDIR%\temp\udd5d2c.tmp
%APPDATA%\360drvmgr\config.ini
%APPDATA%\360drvmgr\360drvmgr_20210223.dat
%TEMP%\_sfx_sx_4562cxj\360drvmgr\signhelper.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\safelive.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\pdown.dll
%ProgramFiles(x86)%\360\360drvmgr\config\skin\tools\tool_1003.png
%ProgramFiles(x86)%\360\360drvmgr\config\skin\tools\tool_1005.png

Deletes the following files

%WINDIR%\temp\udd5d2c.tmp
%TEMP%\_sfx_sx_4562cxj\360drvmgr\computerz_hardwaredll.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\computerz_mini.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\computerz_x64.sys
%TEMP%\_sfx_sx_4562cxj\360drvmgr\config\config.xml
%TEMP%\_sfx_sx_4562cxj\360drvmgr\config\defaultskin\defaultskin.ui
%TEMP%\_sfx_sx_4562cxj\360drvmgr\config\defaultskin\miniui.xml
%TEMP%\_sfx_sx_4562cxj\360drvmgr\downloadmgr.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\drvinst64.exe
%TEMP%\_sfx_sx_4562cxj\360drvmgr\drvmgrui.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\updatecache.dat
%TEMP%\_sfx_sx_4562cxj\360drvmgr\dynlenv.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\hwparams.dat
%TEMP%\_sfx_sx_4562cxj\360drvmgr\liveupd360.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\miniui.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\normal.dat
%TEMP%\_sfx_sx_4562cxj\360drvmgr\pdown.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\safelive.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\signhelper.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\computerzservice.exe
%TEMP%\_sfx_sx_4562cxj\360drvmgr\drvmgrcore.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\computerz5.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\360drvmgr.exe
%WINDIR%\temp\udde225.tmp
%APPDATA%\360drvmgr\360drvmgr_plugin_update\~8861.cab
%APPDATA%\360drvmgr\360drvmgr_plugin_update\~ee16.cab.mem
%TEMP%\{c9438009-0048-4ffe-8629-1cecbdd83b96}.tmp
%APPDATA%\360drvmgr\360drvmgr_plugin_update\360drvmgrupd.ini
%TEMP%\{b6cd5934-0e63-4907-8244-5e9011f50c09}.tmp
%TEMP%\_sfx_sx_4562cxj\360drvmgr\360base.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\360common.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\360net.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\computerz2.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\360netbase.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\360p2sp.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\atiags32.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\computerz.dat
%TEMP%\_sfx_sx_4562cxj\360drvmgr\computerz.set
%TEMP%\_sfx_sx_4562cxj\360drvmgr\computerz.sys
%TEMP%\_sfx_sx_4562cxj\360drvmgr\computerz0.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\computerz1.dll
%TEMP%\_sfx_sx_4562cxj\360drvmgr\computerz4.dll
<DRIVERS>\360sensor_dm64.sys

Moves the following files

from %APPDATA%\360drvmgr\360drvmgr_plugin_update\~8861.cab.~p2s to %APPDATA%\360drvmgr\360drvmgr_plugin_update\~8861.cab
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\computerz1.dll to %ProgramFiles(x86)%\360\360drvmgr\computerz1.dll
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\computerz2.dll to %ProgramFiles(x86)%\360\360drvmgr\computerz2.dll
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\computerz5.dll to %ProgramFiles(x86)%\360\360drvmgr\computerz5.dll
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\computerz_hardwaredll.dll to %ProgramFiles(x86)%\360\360drvmgr\computerz_hardwaredll.dll
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\datamgr.dll to %ProgramFiles(x86)%\360\360drvmgr\datamgr.dll
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\difxapi_x86.dll to %ProgramFiles(x86)%\360\360drvmgr\difxapi_x86.dll
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\downloadmgr.dll to %ProgramFiles(x86)%\360\360drvmgr\downloadmgr.dll
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\drvmgrcore.dll to %ProgramFiles(x86)%\360\360drvmgr\drvmgrcore.dll
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\drvmgrservice.dll to %ProgramFiles(x86)%\360\360drvmgr\drvmgrservice.dll
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\drvmgrui.dll to %ProgramFiles(x86)%\360\360drvmgr\drvmgrui.dll
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\dynlbase.dll to %ProgramFiles(x86)%\360\360drvmgr\dynlbase.dll
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\drvinst64.exe to %ProgramFiles(x86)%\360\360drvmgr\drvinst64.exe
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\dynlenv.dll to %ProgramFiles(x86)%\360\360drvmgr\dynlenv.dll
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\miniui.dll to %ProgramFiles(x86)%\360\360drvmgr\miniui.dll
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\pdown.dll to %ProgramFiles(x86)%\360\360drvmgr\pdown.dll
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\safelive.dll to %ProgramFiles(x86)%\360\360drvmgr\safelive.dll
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\signhelper.dll to %ProgramFiles(x86)%\360\360drvmgr\signhelper.dll
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\sqlite3.dll to %ProgramFiles(x86)%\360\360drvmgr\sqlite3.dll
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\tempmonitor.dll to %ProgramFiles(x86)%\360\360drvmgr\tempmonitor.dll
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\tmdeskband.dll to %ProgramFiles(x86)%\360\360drvmgr\tmdeskband.dll
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\tmdeskband64.dll to %ProgramFiles(x86)%\360\360drvmgr\tmdeskband64.dll
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\netmon\360sensordrv\360sensor_dm.sys to %ProgramFiles(x86)%\360\360drvmgr\netmon\360sensordrv\360sensor_dm.sys
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\netmon\360sensordrv\360sensor_dm64.sys to %ProgramFiles(x86)%\360\360drvmgr\netmon\360sensordrv\360sensor_dm64.sys
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\computerz.sys to %ProgramFiles(x86)%\360\360drvmgr\computerz.sys
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\atiags32.dll to %ProgramFiles(x86)%\360\360drvmgr\atiags32.dll
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\cloudcom2.dll to %ProgramFiles(x86)%\360\360drvmgr\cloudcom2.dll
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\7za.dll to %ProgramFiles(x86)%\360\360drvmgr\7za.dll
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\netmon\360sensor.dll to %ProgramFiles(x86)%\360\360drvmgr\netmon\360sensor.dll
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\360p2sp.dll to %ProgramFiles(x86)%\360\360drvmgr\360p2sp.dll
from %TEMP%\{05cf31ab-0c51-48bd-9ace-537e43c7d279}.tmp\7z.dll to %TEMP%\{bb5268b7-0f14-4cbd-8319-184a2c1d53ba}.tmp
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\config\config.xml to %ProgramFiles(x86)%\360\360drvmgr\config\config.xml
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\config\defaultskin\miniui.xml to %ProgramFiles(x86)%\360\360drvmgr\config\defaultskin\miniui.xml
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\360libdrvmgr.dat to %ProgramFiles(x86)%\360\360drvmgr\360libdrvmgr.dat
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\cacert.dat to %ProgramFiles(x86)%\360\360drvmgr\cacert.dat
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\endata\h_1.dat to %ProgramFiles(x86)%\360\360drvmgr\endata\h_1.dat
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\endata\h_2.dat to %ProgramFiles(x86)%\360\360drvmgr\endata\h_2.dat
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\endata\h_3.dat to %ProgramFiles(x86)%\360\360drvmgr\endata\h_3.dat
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\config\defaultskin\defaultskin.ui to %ProgramFiles(x86)%\360\360drvmgr\config\defaultskin\defaultskin.ui
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\360drvmgr.exe to %ProgramFiles(x86)%\360\360drvmgr\360drvmgr.exe
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\feedback\360screencapture.exe to %ProgramFiles(x86)%\360\360drvmgr\feedback\360screencapture.exe
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\computerz_x64.sys to %ProgramFiles(x86)%\360\360drvmgr\computerz_x64.sys
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\liveupd360.dll to %ProgramFiles(x86)%\360\360drvmgr\liveupd360.dll
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\computerzservice.exe to %ProgramFiles(x86)%\360\360drvmgr\computerzservice.exe
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\installtmdb.exe to %ProgramFiles(x86)%\360\360drvmgr\installtmdb.exe
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\installtmdb64.exe to %ProgramFiles(x86)%\360\360drvmgr\installtmdb64.exe
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\inst_drvmgr.exe to %ProgramFiles(x86)%\360\360drvmgr\inst_drvmgr.exe
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\liveupdate360.exe to %ProgramFiles(x86)%\360\360drvmgr\liveupdate360.exe
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\scriptexecute.exe to %ProgramFiles(x86)%\360\360drvmgr\scriptexecute.exe
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\uninst.exe to %ProgramFiles(x86)%\360\360drvmgr\uninst.exe
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\360base.dll to %ProgramFiles(x86)%\360\360drvmgr\360base.dll
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\360common.dll to %ProgramFiles(x86)%\360\360drvmgr\360common.dll
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\360net.dll to %ProgramFiles(x86)%\360\360drvmgr\360net.dll
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\360netbase.dll to %ProgramFiles(x86)%\360\360drvmgr\360netbase.dll
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\360netul.dll to %ProgramFiles(x86)%\360\360drvmgr\360netul.dll
from %APPDATA%\360drvmgr\360drvmgr_plugin_update\~ee16.cab.p2p to %APPDATA%\360drvmgr\360drvmgr_plugin_update\~ee16.cab
from %TEMP%\{ecfdab8d-e6c1-4768-ad92-002a0290018d}.tmp\feedback\drvmgrfeedback.exe to %ProgramFiles(x86)%\360\360drvmgr\feedback\drvmgrfeedback.exe
from %TEMP%\{bb5268b7-0f14-4cbd-8319-184a2c1d53ba}.tmp to %ProgramFiles(x86)%\360\360drvmgr\7z.dll

Substitutes the following files

<DRIVERS>\360sensor_dm64.sys

Network activity

Connects to

'up####.360safe.com':80
'dl.##0safe.com':80
'ap#.###ver.360safe.com':80
'co##.wsm.360.cn':80
'p0.##img.com':80

TCP

HTTP GET requests

http://dl.##0safe.com/360drvmgrinstaller_betaexe_d60daaaa3bb32661f4927ae97a5975e6_2.0.0.1640.cab

HTTP POST requests

http://ap#.###ver.360safe.com/appserv/qd_queryc.3.0.php?c=############
http://co##.wsm.360.cn/client/query2?m=#############################################################

UDP

DNS ASK re#.#hsetup.com
DNS ASK up####.360safe.com
DNS ASK in#.###ate.360safe.com
DNS ASK dl.##0safe.com
DNS ASK ag#.#.360.cn
DNS ASK ap#.###ver.360safe.com
DNS ASK co##.wsm.360.cn
DNS ASK p0.##img.com

Miscellaneous

Searches for the following windows

ClassName: 'MS_WINHELP' WindowName: ''
ClassName: 'ComputerZService' WindowName: ''
ClassName: 'MPWClass' WindowName: ''
ClassName: 'LiveUpd360S' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Creates and executes the following

'%TEMP%\_sfx_sx_4562cxj\360drvmgr\360drvmgr.exe'
'%TEMP%\_sfx_sx_4562cxj\360drvmgr\computerzservice.exe'
'%APPDATA%\360drvmgr\360drvmgr_plugin_update\360drvmgrinstaller_beta.exe' /S /R
'%ProgramFiles(x86)%\360\360drvmgr\360drvmgr.exe' /run_by_installer
'%ProgramFiles(x86)%\360\360drvmgr\scriptexecute.exe' /uninstallSrv
'%ProgramFiles(x86)%\360\360drvmgr\computerzservice.exe'
'%TEMP%\_sfx_sx_4562cxj\360drvmgr\computerzservice.exe' ' (with hidden window)
'%ProgramFiles(x86)%\360\360drvmgr\computerzservice.exe' ' (with hidden window)

Executes the following

'%WINDIR%\syswow64\svchost.exe' -k Drv_Mgr_Service

Tecnologías

Términos

Formación y educación

Mitos

Technical Information

Curing recommendations

Free trial