File name: D1C7.tmp.exe Detection ratio: 1 / 55 再来一个IPS未拦截的，貌似加密

墨家小子

SHA256:        5eb2875a81816e2b61c1c7f8693a380756d4ee37290f78188ad9caf4d847f982
File name:        D1C7.tmp.exe
Detection ratio:        1 / 55
Analysis date:        2016-03-01 10:03:45 UTC ( 3 minutes ago )
https://www.virustotal.com/en/file/5eb2875a81816e2b61c1c7f8693a380756d4ee37290f78188ad9caf4d847f982/analysis/1456826625/

Qihoo-360        HEUR/QVM07.1.Malware.Gen        20160301

日了狗了，纯爷们实机又碰见一个IPS未拦截的挂马网页，幸亏HMPA出手及时，不然我这英俊潇洒风流倜傥一枝梨花压海棠纵横情场无敌手泡尽千百美女的大帅帅也要栽在这样本手上……到时我纵横毒窝数十载，江湖人称玉面小飞龙的尊号也旦夕不保啊 ·啊啊啊~


类别： 下载智能分析
日期和时间,风险,活动,状态,活动
2016/3/1 17:51:38,低,下载智能分析已扫描 4A.tmp.exe,允许访问,已执行的威胁操作: 0
2016/3/1 17:51:24,低,下载智能分析已扫描 D1C7.tmp.exe,允许访问,已执行的威胁操作: 0

ymb668888

2个样本，卡巴均能云杀，断网双击，主防全部拦截，并回滚

01.03.2016 18.20.27;恶意程序的操作已回滚;PDM:Trojan.Win32.Generic;C:\Users\Administrator\Downloads\D1C7.tmp.exe;c:\users\administrator\downloads\d1c7.tmp.exe;03/01/2016 18:20:27
01.03.2016 18.20.27;恶意程序的操作已回滚;PDM:Trojan.Win32.Generic;C:\Users\Administrator\Downloads\D1C7.tmp.exe;c:\users\administrator\downloads\d1c7.tmp.exe;03/01/2016 18:20:27
01.03.2016 18.20.27;恶意程序的操作已回滚;PDM:Trojan.Win32.Generic;C:\Users\Administrator\Downloads\D1C7.tmp.exe;c:\sandbox\administrator\defaultbox\drive\c\windows\nnrpqogrsheo.exe;03/01/2016 18:20:27
01.03.2016 18.20.27;恶意程序的操作已回滚;PDM:Trojan.Win32.Generic;C:\Users\Administrator\Downloads\D1C7.tmp.exe;c:\sandbox\administrator\defaultbox\drive\c\windows\nnrpqogrsheo.exe;03/01/2016 18:20:27
01.03.2016 18.20.27;回滚恶意程序的操作时文件被恢复;c:\sandbox\administrator\defaultbox\user\current\appdata\local\microsoft\windows\temporary internet files\content.ie5\31a2ddz8\9-220x124[1].jpg;c:\sandbox\administrator\defaultbox\user\current\appdata\local\microsoft\windows\temporary internet files\content.ie5\31a2ddz8\9-220x124[1].jpg;C:\Sandbox\Administrator\DefaultBox\drive\C\Windows\nnrpqogrsheo.exe;c:\users\administrator\downloads\d1c7.tmp.exe;03/01/2016 18:20:27
01.03.2016 18.20.27;回滚恶意程序的操作时文件被恢复;c:\sandbox\administrator\defaultbox\user\current\appdata\local\microsoft\internet explorer\brndlog.txt;c:\sandbox\administrator\defaultbox\user\current\appdata\local\microsoft\internet explorer\brndlog.txt;C:\Sandbox\Administrator\DefaultBox\drive\C\Windows\nnrpqogrsheo.exe;c:\users\administrator\downloads\d1c7.tmp.exe;03/01/2016 18:20:27
01.03.2016 18.20.27;回滚恶意程序的操作时文件被恢复;c:\sandbox\administrator\defaultbox\user\current\appdata\local\adobe\_recovery_+vmpdx.txt;c:\sandbox\administrator\defaultbox\user\current\appdata\local\adobe\_recovery_+vmpdx.txt;C:\Sandbox\Administrator\DefaultBox\drive\C\Windows\nnrpqogrsheo.exe;c:\users\administrator\downloads\d1c7.tmp.exe;03/01/2016 18:20:27
01.03.2016 18.20.27;回滚恶意程序的操作时文件被恢复;c:\sandbox\administrator\defaultbox\user\current\appdata\local\adobe\color\_recovery_+vmpdx.txt;c:\sandbox\administrator\defaultbox\user\current\appdata\local\adobe\color\_recovery_+vmpdx.txt;C:\Sandbox\Administrator\DefaultBox\drive\C\Windows\nnrpqogrsheo.exe;c:\users\administrator\downloads\d1c7.tmp.exe;03/01/2016 18:20:27
01.03.2016 18.20.27;回滚恶意程序的操作时文件被恢复;c:\sandbox\administrator\defaultbox\user\current\appdata\local\adobe\color\profiles\_recovery_+vmpdx.txt;c:\sandbox\administrator\defaultbox\user\current\appdata\local\adobe\color\profiles\_recovery_+vmpdx.txt;C:\Sandbox\Administrator\DefaultBox\drive\C\Windows\nnrpqogrsheo.exe;c:\users\administrator\downloads\d1c7.tmp.exe;03/01/2016 18:20:27
01.03.2016 18.20.27;回滚恶意程序的操作时文件被恢复;c:\sandbox\administrator\defaultbox\user\current\appdata\local\adobe\acrobat\_recovery_+vmpdx.txt;c:\sandbox\administrator\defaultbox\user\current\appdata\local\adobe\acrobat\_recovery_+vmpdx.txt;C:\Sandbox\Administrator\DefaultBox\drive\C\Windows\nnrpqogrsheo.exe;c:\users\administrator\downloads\d1c7.tmp.exe;03/01/2016 18:20:27
01.03.2016 18.20.27;回滚恶意程序的操作时文件被恢复;c:\sandbox\administrator\defaultbox\user\current\appdata\local\adobe\acrobat\11.0\_recovery_+vmpdx.txt;c:\sandbox\administrator\defaultbox\user\current\appdata\local\adobe\acrobat\11.0\_recovery_+vmpdx.txt;C:\Sandbox\Administrator\DefaultBox\drive\C\Windows\nnrpqogrsheo.exe;c:\users\administrator\downloads\d1c7.tmp.exe;03/01/2016 18:20:27
01.03.2016 18.20.27;回滚恶意程序的操作时文件被恢复;c:\sandbox\administrator\defaultbox\user\current\appdata\local\adobe\acrobat\11.0\cache\_recovery_+vmpdx.txt;c:\sandbox\administrator\defaultbox\user\current\appdata\local\adobe\acrobat\11.0\cache\_recovery_+vmpdx.txt;C:\Sandbox\Administrator\DefaultBox\drive\C\Windows\nnrpqogrsheo.exe;c:\users\administrator\downloads\d1c7.tmp.exe;03/01/2016 18:20:27
01.03.2016 18.20.27;回滚恶意程序的操作时文件被恢复;c:\sandbox\administrator\defaultbox\drive\c\$recycle.bin\s-1-5-21-2382313841-2341094415-2425494424-500\$r6hnfno.zip;c:\sandbox\administrator\defaultbox\drive\c\$recycle.bin\s-1-5-21-2382313841-2341094415-2425494424-500\$r6hnfno.zip;C:\Sandbox\Administrator\DefaultBox\drive\C\Windows\nnrpqogrsheo.exe;c:\users\administrator\downloads\d1c7.tmp.exe;03/01/2016 18:20:27
01.03.2016 18.20.27;回滚恶意程序的操作时文件被恢复;c:\sandbox\administrator\defaultbox\drive\c\$recycle.bin\s-1-5-21-2382313841-2341094415-2425494424-500\$i6hnfno.zip;c:\sandbox\administrator\defaultbox\drive\c\$recycle.bin\s-1-5-21-2382313841-2341094415-2425494424-500\$i6hnfno.zip;C:\Sandbox\Administrator\DefaultBox\drive\C\Windows\nnrpqogrsheo.exe;c:\users\administrator\downloads\d1c7.tmp.exe;03/01/2016 18:20:27
01.03.2016 18.18.40;恶意程序已删除;PDM:Trojan.Win32.Generic;C:\Users\Administrator\Downloads\D1C7.tmp.exe;c:\users\administrator\downloads\d1c7.tmp.exe;03/01/2016 18:18:40
01.03.2016 18.18.40;恶意程序已删除;PDM:Trojan.Win32.Generic;C:\Users\Administrator\Downloads\D1C7.tmp.exe;c:\users\administrator\downloads\d1c7.tmp.exe;03/01/2016 18:18:40
01.03.2016 18.18.40;恶意程序已删除;PDM:Trojan.Win32.Generic;C:\Users\Administrator\Downloads\D1C7.tmp.exe;c:\sandbox\administrator\defaultbox\drive\c\windows\nnrpqogrsheo.exe;03/01/2016 18:18:40
01.03.2016 18.18.40;恶意程序已删除;PDM:Trojan.Win32.Generic;C:\Users\Administrator\Downloads\D1C7.tmp.exe;c:\sandbox\administrator\defaultbox\drive\c\windows\nnrpqogrsheo.exe;03/01/2016 18:18:40
01.03.2016 18.18.25;恶意程序已终止;PDM:Trojan.Win32.Generic;Portfolio Popped Sanitisers;c:\users\administrator\downloads\d1c7.tmp.exe;03/01/2016 18:18:25
01.03.2016 18.18.25;恶意程序已终止;PDM:Trojan.Win32.Generic;Portfolio Popped Sanitisers;c:\users\administrator\downloads\d1c7.tmp.exe;03/01/2016 18:18:25
01.03.2016 18.18.25;恶意程序已终止;PDM:Trojan.Win32.Generic;Portfolio Popped Sanitisers;c:\sandbox\administrator\defaultbox\drive\c\windows\nnrpqogrsheo.exe;03/01/2016 18:18:25
01.03.2016 18.18.25;恶意程序已终止;PDM:Trojan.Win32.Generic;Portfolio Popped Sanitisers;c:\sandbox\administrator\defaultbox\drive\c\windows\nnrpqogrsheo.exe;03/01/2016 18:18:25
01.03.2016 18.18.25;检测到恶意程序;PDM:Trojan.Win32.Generic;Portfolio Popped Sanitisers;c:\sandbox\administrator\defaultbox\drive\c\windows\nnrpqogrsheo.exe;03/01/2016 18:18:25
01.03.2016 18.18.25;检测到恶意程序;PDM:Trojan.Win32.Generic;Portfolio Popped Sanitisers;c:\sandbox\administrator\defaultbox\drive\c\windows\nnrpqogrsheo.exe;03/01/2016 18:18:25
01.03.2016 18.18.25;检测到恶意程序;PDM:Trojan.Win32.Generic;Portfolio Popped Sanitisers;c:\users\administrator\downloads\d1c7.tmp.exe;03/01/2016 18:18:25
01.03.2016 18.18.25;检测到恶意程序;PDM:Trojan.Win32.Generic;Portfolio Popped Sanitisers;c:\users\administrator\downloads\d1c7.tmp.exe;03/01/2016 18:18:25
01.03.2016 18.14.40;恶意程序的操作已回滚;PDM:Trojan.Win32.Generic;C:\Users\Administrator\Downloads\4A.tmp.exe;c:\users\administrator\downloads\4a.tmp.exe;03/01/2016 18:14:40
01.03.2016 18.14.40;恶意程序的操作已回滚;PDM:Trojan.Win32.Generic;C:\Users\Administrator\Downloads\4A.tmp.exe;c:\users\administrator\downloads\4a.tmp.exe;03/01/2016 18:14:40
01.03.2016 18.14.40;恶意程序的操作已回滚;PDM:Trojan.Win32.Generic;C:\Users\Administrator\Downloads\4A.tmp.exe;c:\sandbox\administrator\defaultbox\drive\c\windows\echivpyifoiv.exe;03/01/2016 18:14:40
01.03.2016 18.14.40;恶意程序的操作已回滚;PDM:Trojan.Win32.Generic;C:\Users\Administrator\Downloads\4A.tmp.exe;c:\sandbox\administrator\defaultbox\drive\c\windows\echivpyifoiv.exe;03/01/2016 18:14:40
01.03.2016 18.14.40;回滚恶意程序的操作时文件被恢复;c:\sandbox\administrator\defaultbox\user\current\appdata\local\microsoft\windows\temporary internet files\content.ie5\31a2ddz8\9-220x124[1].jpg;c:\sandbox\administrator\defaultbox\user\current\appdata\local\microsoft\windows\temporary internet files\content.ie5\31a2ddz8\9-220x124[1].jpg;C:\Sandbox\Administrator\DefaultBox\drive\C\Windows\echivpyifoiv.exe;c:\users\administrator\downloads\4a.tmp.exe;03/01/2016 18:14:40
01.03.2016 18.14.40;回滚恶意程序的操作时文件被恢复;c:\sandbox\administrator\defaultbox\user\current\appdata\local\microsoft\internet explorer\brndlog.txt;c:\sandbox\administrator\defaultbox\user\current\appdata\local\microsoft\internet explorer\brndlog.txt;C:\Sandbox\Administrator\DefaultBox\drive\C\Windows\echivpyifoiv.exe;c:\users\administrator\downloads\4a.tmp.exe;03/01/2016 18:14:40
01.03.2016 18.14.40;回滚恶意程序的操作时文件被恢复;c:\sandbox\administrator\defaultbox\user\current\appdata\local\adobe\_recovery_+wwtuv.txt;c:\sandbox\administrator\defaultbox\user\current\appdata\local\adobe\_recovery_+wwtuv.txt;C:\Sandbox\Administrator\DefaultBox\drive\C\Windows\echivpyifoiv.exe;c:\users\administrator\downloads\4a.tmp.exe;03/01/2016 18:14:40
01.03.2016 18.14.40;回滚恶意程序的操作时文件被恢复;c:\sandbox\administrator\defaultbox\user\current\appdata\local\adobe\color\_recovery_+wwtuv.txt;c:\sandbox\administrator\defaultbox\user\current\appdata\local\adobe\color\_recovery_+wwtuv.txt;C:\Sandbox\Administrator\DefaultBox\drive\C\Windows\echivpyifoiv.exe;c:\users\administrator\downloads\4a.tmp.exe;03/01/2016 18:14:40
01.03.2016 18.14.40;回滚恶意程序的操作时文件被恢复;c:\sandbox\administrator\defaultbox\user\current\appdata\local\adobe\color\profiles\_recovery_+wwtuv.txt;c:\sandbox\administrator\defaultbox\user\current\appdata\local\adobe\color\profiles\_recovery_+wwtuv.txt;C:\Sandbox\Administrator\DefaultBox\drive\C\Windows\echivpyifoiv.exe;c:\users\administrator\downloads\4a.tmp.exe;03/01/2016 18:14:40
01.03.2016 18.14.40;回滚恶意程序的操作时文件被恢复;c:\sandbox\administrator\defaultbox\user\current\appdata\local\adobe\acrobat\_recovery_+wwtuv.txt;c:\sandbox\administrator\defaultbox\user\current\appdata\local\adobe\acrobat\_recovery_+wwtuv.txt;C:\Sandbox\Administrator\DefaultBox\drive\C\Windows\echivpyifoiv.exe;c:\users\administrator\downloads\4a.tmp.exe;03/01/2016 18:14:40
01.03.2016 18.14.40;回滚恶意程序的操作时文件被恢复;c:\sandbox\administrator\defaultbox\user\current\appdata\local\adobe\acrobat\11.0\_recovery_+wwtuv.txt;c:\sandbox\administrator\defaultbox\user\current\appdata\local\adobe\acrobat\11.0\_recovery_+wwtuv.txt;C:\Sandbox\Administrator\DefaultBox\drive\C\Windows\echivpyifoiv.exe;c:\users\administrator\downloads\4a.tmp.exe;03/01/2016 18:14:40
01.03.2016 18.14.40;回滚恶意程序的操作时文件被恢复;c:\sandbox\administrator\defaultbox\user\current\appdata\local\adobe\acrobat\11.0\cache\_recovery_+wwtuv.txt;c:\sandbox\administrator\defaultbox\user\current\appdata\local\adobe\acrobat\11.0\cache\_recovery_+wwtuv.txt;C:\Sandbox\Administrator\DefaultBox\drive\C\Windows\echivpyifoiv.exe;c:\users\administrator\downloads\4a.tmp.exe;03/01/2016 18:14:40
01.03.2016 18.14.40;回滚恶意程序的操作时文件被恢复;c:\sandbox\administrator\defaultbox\drive\c\$recycle.bin\s-1-5-21-2382313841-2341094415-2425494424-500\$r6hnfno.zip;c:\sandbox\administrator\defaultbox\drive\c\$recycle.bin\s-1-5-21-2382313841-2341094415-2425494424-500\$r6hnfno.zip;C:\Sandbox\Administrator\DefaultBox\drive\C\Windows\echivpyifoiv.exe;c:\users\administrator\downloads\4a.tmp.exe;03/01/2016 18:14:40
01.03.2016 18.14.40;回滚恶意程序的操作时文件被恢复;c:\sandbox\administrator\defaultbox\drive\c\$recycle.bin\s-1-5-21-2382313841-2341094415-2425494424-500\$i6hnfno.zip;c:\sandbox\administrator\defaultbox\drive\c\$recycle.bin\s-1-5-21-2382313841-2341094415-2425494424-500\$i6hnfno.zip;C:\Sandbox\Administrator\DefaultBox\drive\C\Windows\echivpyifoiv.exe;c:\users\administrator\downloads\4a.tmp.exe;03/01/2016 18:14:40
01.03.2016 18.12.49;恶意程序已删除;PDM:Trojan.Win32.Generic;C:\Users\Administrator\Downloads\4A.tmp.exe;c:\users\administrator\downloads\4a.tmp.exe;03/01/2016 18:12:49
01.03.2016 18.12.49;恶意程序已删除;PDM:Trojan.Win32.Generic;C:\Users\Administrator\Downloads\4A.tmp.exe;c:\users\administrator\downloads\4a.tmp.exe;03/01/2016 18:12:49
01.03.2016 18.12.49;恶意程序已删除;PDM:Trojan.Win32.Generic;C:\Users\Administrator\Downloads\4A.tmp.exe;c:\sandbox\administrator\defaultbox\drive\c\windows\echivpyifoiv.exe;03/01/2016 18:12:49
01.03.2016 18.12.49;恶意程序已删除;PDM:Trojan.Win32.Generic;C:\Users\Administrator\Downloads\4A.tmp.exe;c:\sandbox\administrator\defaultbox\drive\c\windows\echivpyifoiv.exe;03/01/2016 18:12:49
01.03.2016 18.12.25;恶意程序已终止;PDM:Trojan.Win32.Generic;Portfolio Popped Sanitisers;C:\Sandbox\Administrator\DefaultBox\drive\C\Windows\echivpyifoiv.exe;03/01/2016 18:12:25
01.03.2016 18.12.25;检测到恶意程序;PDM:Trojan.Win32.Generic;Portfolio Popped Sanitisers;c:\users\administrator\downloads\4a.tmp.exe;03/01/2016 18:12:25
01.03.2016 18.12.25;检测到恶意程序;PDM:Trojan.Win32.Generic;Portfolio Popped Sanitisers;c:\sandbox\administrator\defaultbox\drive\c\windows\echivpyifoiv.exe;03/01/2016 18:12:25
01.03.2016 18.12.25;检测到恶意程序;PDM:Trojan.Win32.Generic;Portfolio Popped Sanitisers;c:\sandbox\administrator\defaultbox\drive\c\windows\echivpyifoiv.exe;03/01/2016 18:12:25
01.03.2016 18.12.25;检测到恶意程序;PDM:Trojan.Win32.Generic;Portfolio Popped Sanitisers;c:\users\administrator\downloads\4a.tmp.exe;03/01/2016 18:12:25

aiqinghe

诺顿NS 扫描无反应 双击sonar发威

文件名: 4a.tmp.exe
威胁名称: SONAR.SelfHijack!gen1完整路径: 不可用

____________________________

____________________________


在电脑上的创建时间 
2016-3-1 ( 18:11:58 )

上次使用时间 
2016-3-1 ( 18:11:58 )

启动项目 
否

已启动 
是

SONAR 主动防护监视电脑上的可疑程序活动。

____________________________


4a.tmp.exe 威胁名称: SONAR.SelfHijack!gen1
定位


极少用户信任的文件
诺顿社区中有 不到 5 名用户使用了此文件。

极新的文件
该文件已在 不到 1 周 前发行。

高
此文件具有高风险。


____________________________


来源: 外部介质

源文件:
winrar.exe

创建的文件:
4a.tmp.exe

____________________________

文件操作

文件: c:\documents and settings\elb2\my documents\downloads\downloads\ 4a.tmp.exe 威胁已删除
事件: 正在运行进程: c:\documents and settings\elb2\my documents\downloads\downloads\ 4a.tmp.exe 已终止
____________________________

系统设置操作

事件: 进程启动 (执行者 c:\documents and settings\elb2\my documents\downloads\downloads\4a.tmp.exe, PID:4852) 未采取操作
事件: 进程启动: c:\documents and settings\elb2\my documents\downloads\downloads\ 4a.tmp.exe, PID:4004 (执行者 c:\documents and settings\elb2\my documents\downloads\downloads\4a.tmp.exe, PID:4852) 未采取操作
事件: 进程启动: c:\documents and settings\elb2\my documents\downloads\downloads\ 4a.tmp.exe, PID:4852 (执行者 c:\documents and settings\elb2\my documents\downloads\downloads\4a.tmp.exe, PID:4852) 未采取操作
____________________________


文件指纹 - SHA:
不可用
文件指纹 - MD5:
不可用

文件名: d1c7.tmp.exe
威胁名称: SONAR.SelfHijack!gen1完整路径: 不可用

____________________________

____________________________


在电脑上的创建时间 
2016-3-1 ( 18:11:38 )

上次使用时间 
2016-3-1 ( 18:11:38 )

启动项目 
否

已启动 
是

SONAR 主动防护监视电脑上的可疑程序活动。

____________________________


d1c7.tmp.exe 威胁名称: SONAR.SelfHijack!gen1
定位


极少用户信任的文件
诺顿社区中有 不到 5 名用户使用了此文件。

极新的文件
该文件已在 不到 1 周 前发行。

高
此文件具有高风险。


____________________________


来源: 外部介质

源文件:
winrar.exe

创建的文件:
d1c7.tmp.exe

____________________________

文件操作

文件: c:\documents and settings\elb2\my documents\downloads\downloads\ d1c7.tmp.exe 威胁已删除
事件: 正在运行进程: c:\documents and settings\elb2\my documents\downloads\downloads\ d1c7.tmp.exe 已终止
____________________________

系统设置操作

事件: 进程启动 (执行者 c:\documents and settings\elb2\my documents\downloads\downloads\d1c7.tmp.exe, PID:5208) 未采取操作
事件: 进程启动: c:\documents and settings\elb2\my documents\downloads\downloads\ d1c7.tmp.exe, PID:1176 (执行者 c:\documents and settings\elb2\my documents\downloads\downloads\d1c7.tmp.exe, PID:5208) 未采取操作
事件: 进程启动: c:\documents and settings\elb2\my documents\downloads\downloads\ d1c7.tmp.exe, PID:5208 (执行者 c:\documents and settings\elb2\my documents\downloads\downloads\d1c7.tmp.exe, PID:5208) 未采取操作
____________________________


文件指纹 - SHA:
不可用
文件指纹 - MD5:
不可用

猥琐大叔

windows7爱好者

看到数字报QVM07.1，基本可以确定是加密勒索了

Microsoftheihei

avg
"IDP.Trojan.E13F31C, C:\Users\Administrator\AppData\Local\Temp\Rar$EXa0.920\D1C7.tmp.exe";"已保护";"2016/3/1, 20:08:45";"文件或目录";""

"IDP.Trojan.E13F31C, C:\Users\Administrator\AppData\Local\Temp\Rar$EXa0.920\D1C7.tmp.exe";"已保护";"2016/3/1, 20:08:45";"文件或目录";""

ericdj

GD

saga3721

红伞云查杀'TR/AD.TeslaCrypt.Y (Cloud)' [trojan]

左手

2016-3-1 22:37:11    创建文件 风险级别:未知    阻止并结束进程
进程: c:\documents and settings\administrator\桌面\d1c7.tmp.exe
目标: C:\WINDOWS\mwtgcxicjcle.exe
规则: [文件组]拦截_有关文件创建修改组 -> [文件]*; *.exe

windows7爱好者

事实证明，数字在64位下防护就是渣渣，核晶屁用没有
Win7 X64，关闭下载保护，直接入沙，数字拦截写入操作后，衍生物和原样本都被QVM杀掉

可以看到图中我标示的的文件是防御成功的，但是其他，我不想多说什么了

勒索信千千万，我滴个神啊
@墨家小子