24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 81:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4f0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Agent.BO potentially unwanted application Sample 718d8efde0ba… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 718d8efde0ba…. Malware family: Agent.BO potentially unwanted application. Threat score 100/100. 6/27 AV engines flagged this file. 19 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/718d8efde0ba4ba81ce3d1bf56a0e1a1acaace8f2dae94677473991b27276d91","keywords":["Malicious","Agent.BO potentially unwanted application","malware analysis","sandbox report","threat intelligence","718d8efde0ba4ba81ce3d1bf56a0e1a1acaace8f2dae94677473991b27276d91"],"about":{"@type":"SoftwareApplication","name":"360se.exe","applicationCategory":["peexe","executable"],"identifier":"718d8efde0ba4ba81ce3d1bf56a0e1a1acaace8f2dae94677473991b27276d91","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Agent.BO potentially unwanted application","antivirusDetections":{"malicious":6,"total":27},"behavioralIndicators":{"malicious":19,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Te29,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "360se.exe") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "360se.exe") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "360se.exe") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "360se.exe") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; File: "360se.exe") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; File: "360se.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "360se.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "360se.exe") Found reference to API "RtlMoveMemory" (Indicator: "RtlMoveMemory"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "RtlMoveMemory" (Indicator: "RtlMoveMemory"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00003376.00000001.308317.732F9000.00000002.mdmp")26:T73f,Found reference to API "NtOpenThread" (Indicator: "OpenThread"; File: "360se.exe") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; File: "360se.exe") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThread"; File: "360se.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "360se.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "Wow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00003376.00000001.308317.732F9000.00000002.mdmp")27:Tdc6,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "360se.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "360se.exe") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "360se.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "360se.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "360se.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "360se.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "360se.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "360se.exe") Found reference to API "NtSignalAndWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "360se.exe") Found reference to API "NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "360se.exe") Found reference to API "NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; File: "360se.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "360se.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "360se.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "360se.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "360se.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "360se.exe") Found reference to API "RegisterWaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "360se.exe") Found reference to API "RegisterWaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "360se.exe") Found reference to API "TpSetTimer" (Indicator: "SetTimer"; File: "360se.exe") Found reference to API "TpSetTimerEx" (Indicator: "SetTimer"; File: "360se.exe") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "360se.exe") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001248.00000001.310177.010D8000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001248.00000001.310177.010D8000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00001248.00000001.310177.010D8000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001248.00000001.310177.010D8000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001248.00000001.310177.010D8000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001248.00000001.310177.010D8000.00000002.mdmp")28:T919,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "360se.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "360se.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "360se.exe") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority" (Indicator: "LoadLibrary"; File: "360se.exe") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority : Priority Increased" (Indicator: "LoadLibrary"; File: "360se.exe") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "360se.exe") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "360se.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp, 00000000-00001248.00000001.310177.010D8000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001248.00000001.310177.010D8000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003376.00000001.308317.732F9000.00000002.mdmp")29:T411,Found reference to API "CallWindowProcW" (Indicator: "CallWindowProc"; File: "360se.exe") Found reference to API "CallWindowProcA" (Indicator: "CallWindowProc"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00003376.00000000.308171.03810000.00000004.mdmp, 00000000-00003376.00000001.308317.03810000.00000004.mdmp") Found reference to API "CallWindowProcA" (Indicator: "CallWindowProc"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "CallWindowProcW" (Indicator: "CallWindowProc"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00003552.00000000.307136.039D0000.00000004.mdmp, 00000000-00003552.00000001.307698.039D0000.00000004.mdmp")2a:T4a5,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "360se.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "360se.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp")2b:T506,Found PE header "MZ" - Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003376.00000000.308171.05D82000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003376.00000001.308317.05D82000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007704.00000000.308255.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00007764.00000000.307984.0112B000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00007764.00000000.307984.06463000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007764.00000000.307984.065A7000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007764.00000000.307984.06CA0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007764.00000001.309906.06CA0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007764.00000001.309906.10000000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00007764.00000002.311825.06CA0000.00000004.mdmp")2c:T60b,"360se.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\SHELLFOLDER") "360se.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\SHELLFOLDER") "360se.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\SHELLFOLDER") "360se.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\SHELLFOLDER") "360se.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM") "360se.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{D3162B92-9365-467A-956B-92703ACA08AF}\SHELLFOLDER") "360se.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D3162B92-9365-467A-956B-92703ACA08AF}\SHELLFOLDER") "360se.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D3162B92-9365-467A-956B-92703ACA08AF}\SHELLFOLDER") "360se.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D3162B92-9365-467A-956B-92703ACA08AF}\SHELLFOLDER") "360se.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{D3162B92-9365-467A-956B-92703ACA08AF}\SHELLFOLDER") "360se.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{D3162B92-9365-467A-956B-92703ACA08AF}\SHELLFOLDER")2d:Ta38,"360se.exe" queried SystemProcessInformation at 00000000-00003552-00000C15-3760675864 [PID: 3552] "360se.exe" queried SystemProcessInformation at 00000000-00003552-00000C15-3760686008 [PID: 3552] "360se.exe" queried SystemProcessInformation at 00000000-00003552-00000C15-3761029725 [PID: 3552] "360se.exe" queried SystemProcessInformation at 00000000-00003552-00000C15-3761039178 [PID: 3552] "360se.exe" queried SystemProcessInformation at 00000000-00003552-00000C15-3761234965 [PID: 3552] "360se.exe" queried SystemProcessInformation at 00000000-00003552-00000C15-3761244101 [PID: 3552] "360se.exe" queried SystemProcessInformation at 00000000-00003552-00000C15-3761269395 [PID: 3552] "360se.exe" queried SystemProcessInformation at 00000000-00003552-00000C15-3761279012 [PID: 3552] "360se.exe" queried SystemProcessInformation at 00000000-00003552-00000C15-3761309124 [PID: 3552] "360se.exe" queried SystemProcessInformation at 00000000-00003552-00000C15-3761320704 [PID: 3552] "360se.exe" queried SystemProcessInformation at 00000000-00003552-00000C15-3761351140 [PID: 3552] "360se.exe" queried SystemProcessInformation at 00000000-00003552-00000C15-3761361466 [PID: 3552] "sgfeedbackhelper.exe" queried SystemProcessInformation at 00000000-00007764-00000C15-3774506367 [PID: 7764] "sgfeedbackhelper.exe" queried SystemProcessInformation at 00000000-00007764-00000C15-3774513814 [PID: 7764] "sgfeedbackhelper.exe" queried SystemProcessInformation at 00000000-00007764-00000C15-3774592515 [PID: 7764] "sgfeedbackhelper.exe" queried SystemProcessInformation at 00000000-00007764-00000C15-3774600644 [PID: 7764] "sgfeedbackhelper.exe" queried SystemProcessInformation at 00000000-00007764-00000C15-3775713275 [PID: 7764] "sgfeedbackhelper.exe" queried SystemProcessInformation at 00000000-00007764-00000C15-3775722582 [PID: 7764] "sgfeedbackhelper.exe" queried SystemProcessInformation at 00000000-00007764-00000C15-3775903573 [PID: 7764] "sgfeedbackhelper.exe" queried SystemProcessInformation at 00000000-00007764-00000C15-3775913282 [PID: 7764] "sgfeedbackhelper.exe" queried SystemProcessInformation at 00000000-00007764-00000C15-3778263972 [PID: 7764] "sgfeedbackhelper.exe" queried SystemProcessInformation at 00000000-00007764-00000C15-3778273408 [PID: 7764] "sgfeedbackhelper.exe" queried SystemProcessInformation at 00000000-00007764-00000C15-3779043705 [PID: 7764] "sgfeedbackhelper.exe" queried SystemProcessInformation at 00000000-00007764-00000C15-3779075257 [PID: 7764] "sgfeedbackhelper.exe" queried SystemProcessInformation at 00000000-00007764-00000C15-3779121318 [PID: 7764]2e:T523,SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003552-49648-57-00944CAA SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003552-49648-130-00947ED8 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003552-49648-1472-00945122 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003552-49648-2276-009452B6 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007764-53975-44-010F121D SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007764-53975-46-010E5EFF SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007764-53975-143-01125B00 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007764-53975-5576-00FFAA20 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007764-53975-7811-010E6805 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007764-53975-10194-010E6993 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003376-60889-44-00F1121D SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003376-60889-46-00F05EFF SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003376-60889-143-00F45B00 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003376-60889-5576-00E1AA20 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003376-60889-7811-00F06805 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003376-60889-10192-00F069932f:T878,Found reference to API IsNTAdmin@ADVPACK.DLL at 00000000-00003552-49648-1001-0091BC00 Found reference to API RtlGetNtVersionNumbers@NTDLL.DLL at 00000000-00007764-53975-573-0100F330 Found reference to API SetLayeredWindowAttributes@USER32.DLL at 00000000-00007764-53975-2127-01073C30 Found reference to API UpdateLayeredWindow@USER32.DLL at 00000000-00007764-53975-2128-01073840 Found reference to API IsProcessDPIAware@USER32.DLL at 00000000-00007764-53975-3478-0106A5F0 Found reference to API GetProcessDpiAwarenessInternal@USER32.DLL at 00000000-00007764-53975-3479-0106A4D0 Found reference to API IsWow64Process@KERNEL32.DLL at 00000000-00007764-53975-4380-00FFA510 Found reference to API IsWow64Process@KERNEL32.DLL at 00000000-00007764-53975-5270-0100F6F0 Found reference to API GlobalMemoryStatusEx@KERNEL32.DLL at 00000000-00007764-53975-5568-00FFB1A0 Found reference to API ChangeWindowMessageFilter@USER32.DLL at 00000000-00007764-53975-5840-00FCEF80 Found reference to API GetSystemTimePreciseAsFileTime@KERNEL32.DLL at 00000000-00007764-53975-10458-010E53B1 Found reference to API RtlGetNtVersionNumbers@NTDLL.DLL at 00000000-00003376-60889-573-00E2F330 Found reference to API SetLayeredWindowAttributes@USER32.DLL at 00000000-00003376-60889-2127-00E93C30 Found reference to API UpdateLayeredWindow@USER32.DLL at 00000000-00003376-60889-2128-00E93840 Found reference to API DllGetClassObject@SHELL32.DLL at 00000000-00003376-60889-2288-00ECA220 Found reference to API IsProcessDPIAware@USER32.DLL at 00000000-00003376-60889-3478-00E8A5F0 Found reference to API GetProcessDpiAwarenessInternal@USER32.DLL at 00000000-00003376-60889-3479-00E8A4D0 Found reference to API IsWow64Process@KERNEL32.DLL at 00000000-00003376-60889-4380-00E1A510 Found reference to API IsWow64Process@KERNEL32.DLL at 00000000-00003376-60889-5270-00E2F6F0 Found reference to API GlobalMemoryStatusEx@KERNEL32.DLL at 00000000-00003376-60889-5568-00E1B1A0 Found reference to API ChangeWindowMessageFilter@USER32.DLL at 00000000-00003376-60889-5840-00DEEF80 Found reference to API GetSystemTimePreciseAsFileTime@KERNEL32.DLL at 00000000-00003376-60889-10458-00F053B130:Td85,Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; File: "360se.exe") Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "360se.exe") Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "360se.exe") Found api reference "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; File: "360se.exe") Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "360se.exe") Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; File: "360se.exe") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; File: "360se.exe") Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; File: "360se.exe") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; File: "360se.exe") Found api reference "CertNameToStrW" (Indicator: "CertNameToStrW"; File: "00000000-00007764.00000000.307984.00FB1000.00000020.mdmp") Found api reference "CryptMsgClose" (Indicator: "CryptMsgClose"; File: "00000000-00007764.00000000.307984.00FB1000.00000020.mdmp") Found api reference "CryptMsgGetParam" (Indicator: "CryptMsgGetParam"; File: "00000000-00007764.00000000.307984.00FB1000.00000020.mdmp") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "00000000-00007764.00000000.307984.00FB1000.00000020.mdmp") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "00000000-00007764.00000000.307984.00FB1000.00000020.mdmp") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "00000000-00007764.00000000.307984.00FB1000.00000020.mdmp") Found api reference "CertGetNameStringW" (Indicator: "CertGetNameStringW"; File: "00000000-00007764.00000000.307984.00FB1000.00000020.mdmp") Found api reference "CryptQueryObject" (Indicator: "CryptQueryObject"; File: "00000000-00007764.00000000.307984.00FB1000.00000020.mdmp") Found api reference "CertNameToStrW" (Indicator: "CertNameToStrW"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found api reference "CertGetNameStringW" (Indicator: "CertGetNameStringW"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found api reference "CryptQueryObject" (Indicator: "CryptQueryObject"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found api reference "CryptMsgClose" (Indicator: "CryptMsgClose"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found api reference "CryptMsgGetParam" (Indicator: "CryptMsgGetParam"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; Source: "00000000-00003376.00000001.308317.732F9000.00000002.mdmp")31:T517,Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "360se.exe") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; File: "360se.exe") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "360se.exe") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; File: "360se.exe") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; File: "360se.exe") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00003376.00000001.308317.732F9000.00000002.mdmp")32:T12e7,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003552-49648-10-00962CD0 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00003552-49648-47-00941B10 Assembly shows XOR instruction xor ecx dword ptr [0096A6A0h+eax*4] in Stream UID: 00000000-00003552-49648-47-00941B10 Assembly shows XOR instruction xor ecx 01h in Stream UID: 00000000-00003552-49648-47-00941B10 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00003552-49648-47-00941B10 Assembly shows XOR instruction xor cl bl in Stream UID: 00000000-00003552-49648-47-00941B10 Assembly shows XOR instruction xor edx dword ptr [0096A6A0h+eax*4] in Stream UID: 00000000-00003552-49648-47-00941B10 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00003552-49648-55-009315F0 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00003552-49648-55-009315F0 Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 00000000-00003552-49648-69-009550E8 Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 00000000-00003552-49648-69-009550E8 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00003552-49648-69-009550E8 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00003552-49648-69-009550E8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003552-49648-83-0093AB20 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003552-49648-83-0093AB20 Assembly shows XOR instruction xor ch byte ptr [edx+00h] in Stream UID: 00000000-00003552-49648-84-00931DD0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003552-49648-88-00962CC0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003552-49648-130-00947ED8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003552-49648-130-00947ED8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003552-49648-140-00948376 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003552-49648-181-009623B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003552-49648-183-00962340 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003552-49648-188-00962150 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003552-49648-192-00962000 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003552-49648-203-00961B60 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003552-49648-207-00961AA0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003552-49648-253-0095F7C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003552-49648-280-0095DDE0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003552-49648-424-00943660 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00003552-49648-425-00942D7E Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00003552-49648-425-00942D7E Assembly shows XOR instruction xor ecx dword ptr [0096A6A0h+eax*4] in Stream UID: 00000000-00003552-49648-425-00942D7E Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00003552-49648-425-00942D7E Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00003552-49648-436-00942A86 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003552-49648-437-00941CD0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003552-49648-437-00941CD0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003552-49648-438-009417F0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003552-49648-438-009417F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003552-49648-439-00941870 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003552-49648-439-00941870 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00003552-49648-492-0093EF20 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00003552-49648-492-0093EF20 Assembly shows XOR instruction xor edx 01h in Stream UID: 00000000-00003552-49648-495-0093E1A0 Assembly shows XOR instruction xor dl byte ptr [ecx+eax] in Stream UID: 00000000-00003552-49648-495-0093E1A0 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00003552-49648-495-0093E1A0 Assembly shows XOR instruction xor ecx dword ptr [0096A160h+eax*4] in Stream UID: 00000000-00003552-49648-495-0093E1A0 Assembly shows XOR instruction xor eax edi in Stream UID: 00000000-00003552-49648-495-0093E1A0 Assembly shows XOR instruction xor edi dword ptr [0096A160h+eax*4] in Stream UID: 00000000-00003552-49648-495-0093E1A033:T57c,Found reference to API "BCryptSetProperty" (Indicator: "BCryptSetProperty"; File: "360se.exe") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "360se.exe") Found reference to API "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "360se.exe") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; File: "360se.exe") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "360se.exe") Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; File: "360se.exe") Found reference to API "BCryptGetProperty" (Indicator: "BCryptGetProperty"; File: "360se.exe") Found reference to API "CryptMsgClose" (Indicator: "CryptMsgClose"; File: "00000000-00007764.00000000.307984.00FB1000.00000020.mdmp") Found reference to API "CertCloseStore" (Indicator: "CertCloseStore"; File: "00000000-00007764.00000000.307984.00FB1000.00000020.mdmp") Found reference to API "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "00000000-00007764.00000000.307984.00FB1000.00000020.mdmp") Found reference to API "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "00000000-00007764.00000000.307984.00FB1000.00000020.mdmp") Found reference to API "CertGetNameStringW" (Indicator: "CertGetNameString"; File: "00000000-00007764.00000000.307984.00FB1000.00000020.mdmp")34:T521,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Contains asymmetric cryptographic functions (API string) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains cryptographic functions of the CryptoAPI Matched sigs: Detected Suricata alert – Encrypted channel Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: YARA signature match – cryptographic algorithms Matched sigs: YARA signature match - ChaCha20 encryption algorithm Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Contains key cryptographic functions of the CryptoAPI Matched sigs: YARA signature match - AES encryption35:T12ebc,Found XOR loop in file "bzzbynMgNedca.exe" at offset 896267; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 898802; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 1924970; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2012616; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2153862; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2197094; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2350318; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2454167; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2462957; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2467545; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2468951; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2470931; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2471923; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2475263; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2478985; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2479131; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2628092; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2700265; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2768319; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2913210; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3026772; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3187613; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3195484; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3315600; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3377485; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3415128; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3424526; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3467082; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3542617; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3565040; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3582497; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3582870; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3594425; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3712798; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3751854; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3822811; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3964853; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3974292; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3998415; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4047690; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4103857; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4188010; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4263101; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4302040; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4309088; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4382159; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4403201; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4415260; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4443847; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4536537; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4722487; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4752685; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4780853; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4789905; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4821974; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4854382; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4929404; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4972420; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 5024388; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 5036283; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 5038372; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 5064715; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 5096780; code bytes = 30d0 Found XOR loop in file "bzzbynMgNedca.exe" at offset 96202; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 96279; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 96344; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 96506; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 96600; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 96679; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 96745; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 179910; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 179929; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 179948; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 179967; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 179986; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 180005; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 180024; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 180046; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 180086; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 185644; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 185684; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 186132; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 199446; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 199465; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 199484; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 199503; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 199522; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 199541; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 199560; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 199582; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 199622; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 200585; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 202776; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 205788; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 205828; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 205953; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 208351; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 208395; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 208404; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 208488; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 208517; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 208526; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 208612; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 208636; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 208648; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 208798; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 208825; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 208890; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 208917; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 208982; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 209009; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 209083; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 209108; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 209459; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 209497; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 209566; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 209658; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 209751; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 215488; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 216026; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 519161; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 520535; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 662938; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 663012; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 663710; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 664411; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 664755; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 779668; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 782493; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 784430; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 785016; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 785327; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 786222; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 786814; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 787556; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 788082; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 788891; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 789242; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 799124; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 827376; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 828075; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 828424; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 828801; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 829483; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 829832; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 830433; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 858154; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 858612; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 859059; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 1443288; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 1443309; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 1443330; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 1443399; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 1443491; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 1443590; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 1450958; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 1451974; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 1452103; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 1912234; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 1920101; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 1920549; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 1921125; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 1921573; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2047840; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2049348; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2049540; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2050896; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2440465; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2440467; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2441235; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2453123; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2455205; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2461611; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2640411; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2680640; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2742785; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2755872; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2804917; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2835078; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2841661; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2960252; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3053411; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3106455; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3233798; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3304472; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3330838; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3572626; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3606403; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3610143; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3612854; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3886747; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3890011; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3897212; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3952032; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3970350; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4012225; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4031590; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4247758; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4275630; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4309735; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4414599; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4604182; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4667769; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4764431; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4812410; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4877570; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4898473; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4917916; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4976444; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 5098298; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 5151698; code bytes = 33c1 Found XOR loop in file "bzzbynMgNedca.exe" at offset 77012; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 98051; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 110457; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 118534; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 119353; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 132023; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 140179; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 147864; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 149119; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 149644; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 150072; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 153510; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 165644; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 212194; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 212230; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 212305; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 212499; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 251865; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 253817; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 274539; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 274896; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 379564; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 391914; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 439315; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 558844; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 1928140; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 1940490; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 1992207; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2030678; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2097328; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2253106; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2312956; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2440618; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2442794; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2446032; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2446900; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2449706; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2454160; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2462198; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2466782; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2467516; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2470292; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2471904; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2476580; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2478706; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2481660; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2489296; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2489543; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2495117; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2497384; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2497550; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2634678; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2657950; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2753911; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2759746; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2801758; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2819636; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 2860419; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3023099; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3145725; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3148742; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3169977; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3216990; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3230688; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3263371; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3263929; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3370663; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3421127; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3424075; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3622749; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3653255; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3672735; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3776797; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3833079; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3905457; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 3993024; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4057386; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4174846; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4274923; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4301646; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4303961; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4348350; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4366272; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4392961; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4405497; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4425939; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4451880; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4510834; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4539032; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4712864; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4806767; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4829091; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4856570; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 4909408; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 5050122; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 5166763; code bytes = 8030 Found XOR loop in file "bzzbynMgNedca.exe" at offset 5172863; code bytes = 8030 Found XOR loop in file "ImageMagik.dll" at offset 921247; code bytes = 30d0 Found XOR loop in file "ImageMagik.dll" at offset 2096436; code bytes = 30d0 Found XOR loop in file "ImageMagik.dll" at offset 3149137; code bytes = 30d0 Found XOR loop in file "ImageMagik.dll" at offset 3149444; code bytes = 30d0 Found XOR loop in file "ImageMagik.dll" at offset 3149601; code bytes = 30d0 Found XOR loop in file "ImageMagik.dll" at offset 3156415; code bytes = 30d0 Found XOR loop in file "ImageMagik.dll" at offset 3163654; code bytes = 30d0 Found XOR loop in file "ImageMagik.dll" at offset 3192615; code bytes = 30d0 Found XOR loop in file "ImageMagik.dll" at offset 3192634; code bytes = 30d0 Found XOR loop in file "ImageMagik.dll" at offset 3335425; code bytes = 30d0 Found XOR loop in file "ImageMagik.dll" at offset 4085972; code bytes = 30d0 Found XOR loop in file "ImageMagik.dll" at offset 4086349; code bytes = 30d0 Found XOR loop in file "ImageMagik.dll" at offset 32345; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 153192; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 153197; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 173708; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 274211; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 274216; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 274237; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 274242; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 419416; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 419421; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 423153; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 629628; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 629756; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 632352; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 775315; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 775322; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 979513; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1015149; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1015215; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1116044; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1116088; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1116097; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1116181; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1116210; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1116219; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1116305; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1116329; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1116341; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1116491; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1116518; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1116583; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1116610; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1116675; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1116702; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1116776; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1116801; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1117152; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1117190; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1117259; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1117351; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1117444; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1125292; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1139371; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1144297; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1150290; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1150306; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1150324; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 1628651; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 2229322; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 2229336; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 2229480; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 2235172; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 2235226; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 2235284; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 2235415; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 2235436; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 2235484; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 2235540; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 2235561; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 2235604; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 2235658; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 2235679; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 2235716; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 2520736; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 2521510; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 2521529; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 2521548; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 2521567; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 2521586; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 2521605; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 2521624; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 2521646; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 2521686; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 2547227; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 2596888; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 3086095; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 3292992; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 3579328; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 3579338; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 3717919; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 3768580; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 3772043; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 3965864; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 3967545; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 3971137; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 3971927; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 3972631; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 3973080; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 3976945; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 3977535; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4017964; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4018253; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4018513; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4019515; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4019911; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4020079; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4032756; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4119117; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4119243; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4123457; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4123602; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4140134; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4153347; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4153440; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4228633; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4229196; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4231357; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4231997; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4232675; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4236119; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4243998; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4248204; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4285494; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4288084; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4289294; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4316744; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4321621; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4340845; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4341053; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4341341; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4341647; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4342492; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4343533; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4354516; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4354992; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4376267; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4470089; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4472359; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4472364; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 4979175; code bytes = 33c1 Found XOR loop in file "ImageMagik.dll" at offset 133762; code bytes = 8030 Found XOR loop in file "ImageMagik.dll" at offset 295629; code bytes = 8030 Found XOR loop in file "ImageMagik.dll" at offset 641693; code bytes = 8030 Found XOR loop in file "ImageMagik.dll" at offset 875796; code bytes = 8030 Found XOR loop in file "ImageMagik.dll" at offset 927374; code bytes = 8030 Found XOR loop in file "ImageMagik.dll" at offset 1271708; code bytes = 8030 Found XOR loop in file "ImageMagik.dll" at offset 1655406; code bytes = 8030 Found XOR loop in file "ImageMagik.dll" at offset 1677463; code bytes = 8030 Found XOR loop in file "ImageMagik.dll" at offset 1678003; code bytes = 8030 Found XOR loop in file "ImageMagik.dll" at offset 2407377; code bytes = 8030 Found XOR loop in file "ImageMagik.dll" at offset 3220603; code bytes = 8030 Found XOR loop in file "ImageMagik.dll" at offset 3548186; code bytes = 8030 Found XOR loop in file "ImageMagik.dll" at offset 4206814; code bytes = 8030 Found XOR loop in file "ImageMagik.dll" at offset 4793855; code bytes = 8030 Found XOR loop in file "ImageMagik.dll" at offset 5198868; code bytes = 8030 Found XOR loop in file "HWSignature.dll" at offset 416120; code bytes = 30d0 Found XOR loop in file "HWSignature.dll" at offset 504677; code bytes = 30d0 Found XOR loop in file "HWSignature.dll" at offset 567177; code bytes = 30d0 Found XOR loop in file "HWSignature.dll" at offset 581499; code bytes = 30d0 Found XOR loop in file "HWSignature.dll" at offset 609377; code bytes = 30d0 Found XOR loop in file "HWSignature.dll" at offset 611487; code bytes = 30d0 Found XOR loop in file "HWSignature.dll" at offset 612343; code bytes = 30d0 Found XOR loop in file "HWSignature.dll" at offset 93493; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 93575; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 93643; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 125199; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 125243; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 125252; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 125336; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 125365; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 125374; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 125460; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 125484; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 125496; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 125646; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 125673; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 125738; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 125765; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 125830; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 125857; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 125931; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 125956; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 126307; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 126345; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 126414; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 126506; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 126599; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 132448; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 132938; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 333613; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 337169; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 341848; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 357670; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 367248; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 375121; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 426081; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 608823; code bytes = 33c1 Found XOR loop in file "HWSignature.dll" at offset 396635; code bytes = 8030 Found XOR loop in file "HWSignature.dll" at offset 401513; code bytes = 8030 Found XOR loop in file "HWSignature.dll" at offset 403321; code bytes = 8030 Found XOR loop in file "HWSignature.dll" at offset 418902; code bytes = 8030 Found XOR loop in file "HWSignature.dll" at offset 421120; code bytes = 8030 Found XOR loop in file "HWSignature.dll" at offset 424464; code bytes = 8030 Found XOR loop in file "HWSignature.dll" at offset 603334; code bytes = 8030 Found XOR loop in file "HWSignature.dll" at offset 609348; code bytes = 8030 Found XOR loop in file "HWSignature.dll" at offset 611448; code bytes = 8030 Found XOR loop in file "HWSignature.dll" at offset 612742; code bytes = 8030 Found XOR loop in file "HWSignature.dll" at offset 613298; code bytes = 8030 Found XOR loop in file "HWSignature.dll" at offset 613916; code bytes = 8030 Found XOR loop in file "HWSignature.dll" at offset 615020; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 49539; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 146892; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 1597672; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 1607480; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 1616748; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 1620584; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 1806330; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 1886764; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2298803; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2369921; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2371902; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2394487; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2446708; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2525977; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2590161; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2646271; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2649398; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2676339; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2717652; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2736185; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2807970; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2879109; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2880459; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2913903; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3041407; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3109043; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3159787; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3200765; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3201059; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3214439; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3216099; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3218629; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3233767; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3235087; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3236895; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3238359; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3239859; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3241895; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3243323; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3246811; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3248083; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3249383; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3252587; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3254343; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3255857; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3258043; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3260645; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3264909; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3266695; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3267595; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3271483; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3272669; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3273289; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3274269; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3274801; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3277059; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3279763; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 224792; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 296574; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 296618; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 296627; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 296711; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 296740; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 296749; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 296835; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 296859; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 296871; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 297021; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 297048; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 297113; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 297140; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 297205; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 297232; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 297306; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 297331; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 297682; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 297720; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 297789; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 297881; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 297974; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 309682; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 416853; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 416874; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 416895; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 416964; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 417056; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 417149; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 474170; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 493025; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 691775; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 830943; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 874958; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 934316; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 934355; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 1269406; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 1270116; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 1447920; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 1448599; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 1448715; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2220896; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2237811; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2266104; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2285587; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2479061; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2497146; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2521360; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2616531; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2625785; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2629560; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2642938; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2655445; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2701739; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2765930; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2783121; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3084346; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3208383; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3229007; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 216401; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 469748; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 470070; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 500919; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 501267; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 612416; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 1520081; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 1647052; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 1659402; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 1695332; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 1697564; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 1697811; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 1703324; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2397548; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2461746; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2513087; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2621267; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2626922; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2709299; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2812522; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2947770; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2976516; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 2989048; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3024641; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3059525; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3185388; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3186038; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3188052; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3216834; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3235048; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3236856; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3238320; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3239820; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3241856; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3243284; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3246772; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3248044; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3249344; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3252548; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3254304; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3255826; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3260606; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3265788; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3266680; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3271472; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3273758; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3278732; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3280906; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3284819; code bytes = 8030 Found XOR loop in file "sgfeedbackhelperz.exe" at offset 3287658; code bytes = 8030 Found XOR loop in file "7z.dll" at offset 493219; code bytes = 30d0 Found XOR loop in file "7z.dll" at offset 493252; code bytes = 30d0 Found XOR loop in file "7z.dll" at offset 497094; code bytes = 30d0 Found XOR loop in file "7z.dll" at offset 881013; code bytes = 30d0 Found XOR loop in file "7z.dll" at offset 959815; code bytes = 30d0 Found XOR loop in file "7z.dll" at offset 996657; code bytes = 30d0 Found XOR loop in file "7z.dll" at offset 1087166; code bytes = 30d0 Found XOR loop in file "7z.dll" at offset 1282893; code bytes = 30d0 Found XOR loop in file "7z.dll" at offset 1288637; code bytes = 30d0 Found XOR loop in file "7z.dll" at offset 1293317; code bytes = 30d0 Found XOR loop in file "7z.dll" at offset 1294427; code bytes = 30d0 Found XOR loop in file "7z.dll" at offset 1296017; code bytes = 30d0 Found XOR loop in file "7z.dll" at offset 1298837; code bytes = 30d0 Found XOR loop in file "7z.dll" at offset 1299779; code bytes = 30d0 Found XOR loop in file "7z.dll" at offset 1301241; code bytes = 30d0 Found XOR loop in file "7z.dll" at offset 1302751; code bytes = 30d0 Found XOR loop in file "7z.dll" at offset 1304269; code bytes = 30d0 Found XOR loop in file "7z.dll" at offset 1304781; code bytes = 30d0 Found XOR loop in file "7z.dll" at offset 1309207; code bytes = 30d0 Found XOR loop in file "7z.dll" at offset 1310733; code bytes = 30d0 Found XOR loop in file "7z.dll" at offset 205268; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 311263; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 318275; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 431772; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 468844; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 559784; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 682198; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 682204; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 695379; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 766131; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 766150; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 826943; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 827084; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 829342; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 832021; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 835756; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 848037; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 848229; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 848815; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 892332; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 943969; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 944338; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 944371; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 944404; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 944437; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 944712; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 944781; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 944850; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 944919; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 968696; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 968729; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 968762; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 968795; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 971533; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 971571; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 971580; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 971640; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 971663; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 971672; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 971737; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 971759; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 971776; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 971909; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 971942; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 972007; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 972034; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 972111; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 972132; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 972204; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 972248; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 972608; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 972632; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 972656; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 972741; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 972839; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 972931; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 973030; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 1277733; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 1280667; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 1282331; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 1282917; code bytes = 33c1 Found XOR loop in file "7z.dll" at offset 112528; code bytes = 8030 Found XOR loop in file "7z.dll" at offset 1087165; code bytes = 8030 Found XOR loop in file "7z.dll" at offset 1087174; code bytes = 8030 Found XOR loop in file "7z.dll" at offset 1170871; code bytes = 8030 Found XOR loop in file "7z.dll" at offset 1286178; code bytes = 8030 Found XOR loop in file "7z.dll" at offset 1290188; code bytes = 8030 Found XOR loop in file "7z.dll" at offset 1294388; code bytes = 8030 Found XOR loop in file "7z.dll" at offset 1298798; code bytes = 8030 Found XOR loop in file "7z.dll" at offset 1299764; code bytes = 8030 Found XOR loop in file "7z.dll" at offset 1301234; code bytes = 8030 Found XOR loop in file "7z.dll" at offset 1302744; code bytes = 8030 Found XOR loop in file "7z.dll" at offset 1304262; code bytes = 8030 Found XOR loop in file "7z.dll" at offset 1307508; code bytes = 8030 Found XOR loop in file "7z.dll" at offset 1309200; code bytes = 8030 Found XOR loop in file "7z.dll" at offset 1310288; code bytes = 8030 Found XOR loop in file "7z.dll" at offset 1310694; code bytes = 8030 Found XOR loop in file "7z.exe" at offset 351747; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 352343; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 354093; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 116504; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 259794; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 259827; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 259860; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 259893; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 64132; code bytes = 8030 Found XOR loop in file "7z.exe" at offset 291323; code bytes = 8030 Found XOR loop in file "7z.exe" at offset 341830; code bytes = 8030 Found XOR loop in file "7z.exe" at offset 354614; code bytes = 8030 Found XOR loop in file "jzr.exe" at offset 33317; code bytes = 30d0 Found XOR loop in file "jzr.exe" at offset 34109; code bytes = 30d0 Found XOR loop in file "jzr.exe" at offset 16563; code bytes = 33c1 Found XOR loop in file "jzr.exe" at offset 33308; code bytes = 8030 Found XOR loop in file "jzr.exe" at offset 35398; code bytes = 8030 Found XOR loop in file "jzr.exe" at offset 43398; code bytes = 8030 Found XOR loop in file "jzr.exe" at offset 43475; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 49539; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 146892; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 1597672; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 1607480; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 1616748; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 1620584; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 1806330; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 1886764; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2298803; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2369921; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2371902; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2394487; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2446708; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2525977; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2590161; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2646271; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2649398; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2676339; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2717652; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2736185; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2807970; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2879109; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2880459; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2913903; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3041407; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3109043; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3159787; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3200765; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3201059; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3214439; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3216099; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3218629; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3233767; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3235087; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3236895; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3238359; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3239859; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3241895; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3243323; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3246811; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3248083; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3249383; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3252587; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3254343; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3255857; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3258043; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3260645; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3264909; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3266695; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3267595; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3271483; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3272669; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3273289; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3274269; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3274801; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3277059; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3279763; code bytes = 30d0 Found XOR loop in file "sgfeedbackhelper.exe" at offset 224792; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 296574; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 296618; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 296627; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 296711; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 296740; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 296749; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 296835; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 296859; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 296871; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 297021; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 297048; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 297113; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 297140; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 297205; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 297232; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 297306; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 297331; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 297682; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 297720; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 297789; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 297881; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 297974; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 309682; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 416853; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 416874; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 416895; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 416964; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 417056; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 417149; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 474170; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 493025; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 691775; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 830943; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 874958; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 934316; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 934355; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 1269406; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 1270116; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 1447920; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 1448599; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 1448715; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2220896; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2237811; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2266104; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2285587; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2479061; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2497146; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2521360; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2616531; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2625785; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2629560; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2642938; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2655445; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2701739; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2765930; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2783121; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3084346; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3208383; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3229007; code bytes = 33c1 Found XOR loop in file "sgfeedbackhelper.exe" at offset 216401; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 469748; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 470070; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 500919; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 501267; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 612416; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 1520081; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 1647052; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 1659402; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 1695332; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 1697564; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 1697811; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 1703324; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2397548; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2461746; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2513087; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2621267; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2626922; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2709299; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2812522; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2947770; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2976516; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 2989048; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3024641; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3059525; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3185388; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3186038; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3188052; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3216834; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3235048; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3236856; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3238320; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3239820; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3241856; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3243284; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3246772; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3248044; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3249344; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3252548; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3254304; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3255826; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3260606; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3265788; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3266680; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3271472; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3273758; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3278732; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3280906; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3284819; code bytes = 8030 Found XOR loop in file "sgfeedbackhelper.exe" at offset 3287658; code bytes = 803036:T612,Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "360se.exe") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "360se.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "jzr.exe") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "360se.exe") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; Source: "00000000-00007764-00000C2C-3775410766") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001248.00000001.310177.010D8000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp")37:T5b0,Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "360se.exe") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "360se.exe") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "360se.exe") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "360se.exe") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "360se.exe") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "360se.exe") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp")38:Ta9d,Found string "net/url_request_context/app_request/0x?/cookie_monster/cookies" (Indicator: "/cookies"; File: "360se.exe") Found string "net/url_request_context/extensions/0x?/cookie_monster/cookies" (Indicator: "/cookies"; File: "360se.exe") Found string "net/url_request_context/isolated_media/0x?/cookie_monster/cookies" (Indicator: "/cookies"; File: "360se.exe") Found string "net/url_request_context/main/0x?/cookie_monster/cookies" (Indicator: "/cookies"; File: "360se.exe") Found string "net/url_request_context/main_media/0x?/cookie_monster/cookies" (Indicator: "/cookies"; File: "360se.exe") Found string "net/url_request_context/mirroring/0x?/cookie_monster/cookies" (Indicator: "/cookies"; File: "360se.exe") Found string "net/url_request_context/proxy/0x?/cookie_monster/cookies" (Indicator: "/cookies"; File: "360se.exe") Found string "net/url_request_context/safe_browsing/0x?/cookie_monster/cookies" (Indicator: "/cookies"; File: "360se.exe") Found string "net/url_request_context/system/0x?/cookie_monster/cookies" (Indicator: "/cookies"; File: "360se.exe") Found string "net/url_request_context/unknown/0x?/cookie_monster/cookies" (Indicator: "/cookies"; File: "360se.exe") Found string "net/url_request_context/app_request/0x?/cookie_monster/cookies" (Indicator: "/cookies"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found string "net/url_request_context/extensions/0x?/cookie_monster/cookies" (Indicator: "/cookies"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found string "net/url_request_context/isolated_media/0x?/cookie_monster/cookies" (Indicator: "/cookies"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found string "net/url_request_context/main/0x?/cookie_monster/cookies" (Indicator: "/cookies"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found string "net/url_request_context/main_media/0x?/cookie_monster/cookies" (Indicator: "/cookies"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found string "net/url_request_context/proxy/0x?/cookie_monster/cookies" (Indicator: "/cookies"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found string "net/url_request_context/safe_browsing/0x?/cookie_monster/cookies" (Indicator: "/cookies"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found string "net/url_request_context/system/0x?/cookie_monster/cookies" (Indicator: "/cookies"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found string "net/url_request_context/unknown/0x?/cookie_monster/cookies" (Indicator: "/cookies"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp")39:Tbd4,Found system information discovery API: "GetEnvironmentStringsW" in file "360se.exe" Found system information discovery API: "GetSystemInfo" in file "360se.exe" Found system information discovery API: "RtlNtStatusToDosError" in file "360se.exe" Found system information discovery API: "GetMonitorInfo" in file "360se.exe" Found system information discovery API: ":GetMonitorInfoW" in file "360se.exe" Found system information discovery API: "GetMonitorInfoA" in file "360se.exe" Found system information discovery API: "ExpandEnvironmentStringsW" in file "360se.exe" Found system information discovery API: "GetNativeSystemInfo" in file "360se.exe" Found system information discovery API: "GetMonitorInfoW" in file "360se.exe" Found system information discovery API: "RtlNtStatusToDosErrorNoTeb" in file "360se.exe" Found system information discovery API: "NtQuerySystemInformation" in file "360se.exe" Found system information discovery API: "GetEnvironmentStrings" in "00000000-00001248.00000001.310177.00400000.00000040.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00001248.00000001.310177.00400000.00000040.mdmp" Found system information discovery API: "GetMonitorInfoA" in "00000000-00001248.00000001.310177.00400000.00000040.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00001248.00000001.310177.010D8000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00001248.00000001.310177.010D8000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00001248.00000001.310177.010D8000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosErrorNoTeb" in "00000000-00001248.00000001.310177.010D8000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStrings" in "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp" Found system information discovery API: "GetMonitorInfoA" in "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00003376.00000001.308317.732F9000.00000002.mdmp"3a:T8e6,Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "360se.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "360se.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "360se.exe") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "360se.exe") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "360se.exe") Found reference to API "FindWindowExA" (Indicator: "findwindow"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00003376.00000000.308171.03810000.00000004.mdmp, 00000000-00003376.00000001.308317.03810000.00000004.mdmp") Found reference to API "FindWindowExA" (Indicator: "findwindow"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "findwindow"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00003552.00000000.307136.039D0000.00000004.mdmp, 00000000-00003552.00000001.307698.039D0000.00000004.mdmp")3b:T317a,"360se.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003552) "360se.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003552) "360se.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000008d8510138cf8777ec369d0374d8510101000000a0369d03ec369d03a0369d03040000000400000000e072770010000074d8510101000000a0369d03cd9787779c978777118da75ab50f6977a0369d030000877700000000840a21760000000080ee6f770100000000000000f8e27277000000000400000080a91c7448407177f8e2727778d8510180e8447558149e0380e8447574d851010000000080e84475ec15b2fdfeffffff0000000000000000000000000d00000020c39f0302000000020000001200000000c39f0320c39f0300000000449146c0f8da5101ddf36677ecd851010000000000c39f0312000000f8f3667700c39f03 (UID: 00000000-00003552) "360se.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0000006f00660074005c00570069006e0064006f00770073005c0043006100630068006500730000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b8e6a703d0e6a703 (UID: 00000000-00003552) "360se.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000877740e7a703000000004d338777558fa75a7c00000000009d0320d95101000000000000000000000000000000000200000200000000d92d00f400000000ac0000ac0000000000000000000000000200000200000000000000f400000000000000000000000000000000000000000000000078055905000000000000000000000000a30187770000000000000000270000008cffffff40e7a703000000000f00000038d2ffff030000037805590538dc510114dc510181f195747805590550e15101e0dd5101c5f1957400009d0398348777c8aaa70340dc51011c6092740400000038dc51015c83397570055905a0909974000000000100000000000000 (UID: 00000000-00003552) "360se.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000005101c8c351011b800800cc56280044020000000000000000000000000000a8c351011b80080030c4510158060000d0ca510118000000c50e90b344020000000000009f5728734402000044020000000000000000000000005101000000000000000018000000d0ca510130c451011b800800ad0e90b340c251019f57287358c35101a0182a73053beac1feffffff68c35101222aed734402000000000000000000000000000040c351011b800800c8c351015806000068ca5101642aed733ab409c7f30b0000faffffff80ca5101000000001800000000000000c50e90b30000000000000000ffffffff000000000000000000000000c611a803dc11a803 (UID: 00000000-00003552) "360se.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000005101c8c351011b800800cc56280044020000000000000000000000000000a8c351011b80080030c4510158060000d0ca510118000000c50e90b344020000000000009f5728734402000044020000000000000000000000005101000000000000000018000000d0ca510130c451011b800800ad0e90b340c251019f57287358c35101a0182a73053beac1feffffff68c35101222aed734402000000000000000000000000000040c351011b800800c8c351015806000068ca5101642aed733ab409c7f30b0000faffffff80ca5101000000001800000000000000c50e90b30000000000000000ffffffff000000000000000000000000ae28a803c628a803 (UID: 00000000-00003552) "360se.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000005101c8c351011b800800cc56280044020000000000000000000000000000a8c351011b80080030c4510158060000d0ca510118000000c50e90b344020000000000009f5728734402000044020000000000000000000000005101000000000000000018000000d0ca510130c451011b800800ad0e90b340c251019f57287358c35101a0182a73053beac1feffffff68c35101222aed734402000000000000000000000000000040c351011b800800c8c351015806000068ca5101642aed733ab409c7f30b0000faffffff80ca5101000000001800000000000000c50e90b30000000000000000ffffffff000000000000000000000000b628a803ca28a803 (UID: 00000000-00003552) "360se.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000005101c8c351011b800800cc56280044020000000000000000000000000000a8c351011b80080030c4510158060000d0ca510118000000c50e90b344020000000000009f5728734402000044020000000000000000000000005101000000000000000018000000d0ca510130c451011b800800ad0e90b340c251019f57287358c35101a0182a73053beac1feffffff68c35101222aed734402000000000000000000000000000040c351011b800800c8c351015806000068ca5101642aed733ab409c7f30b0000faffffff80ca5101000000001800000000000000c50e90b30000000000000000ffffffff0000000000000000000000007e3aa803963aa803 (UID: 00000000-00003552) "360se.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000005101c8c351011b800800cc56280044020000000000000000000000000000a8c351011b80080030c4510158060000d0ca510118000000c50e90b344020000000000009f5728734402000044020000000000000000000000005101000000000000000018000000d0ca510130c451011b800800ad0e90b340c251019f57287358c35101a0182a73053beac1feffffff68c35101222aed734402000000000000000000000000000040c351011b800800c8c351015806000068ca5101642aed733ab409c7f30b0000faffffff80ca5101000000001800000000000000c50e90b30000000000000000ffffffff0000000000000000000000009e39a803b439a803 (UID: 00000000-00003552) "360se.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000005101c8c351011b800800cc56280044020000000000000000000000000000a8c351011b80080030c4510158060000d0ca510118000000c50e90b344020000000000009f5728734402000044020000000000000000000000005101000000000000000018000000d0ca510130c451011b800800ad0e90b340c251019f57287358c35101a0182a73053beac1feffffff68c35101222aed734402000000000000000000000000000040c351011b800800c8c351015806000068ca5101642aed733ab409c7f30b0000faffffff80ca5101000000001800000000000000c50e90b30000000000000000ffffffff000000000000000000000000763ea8038e3ea803 (UID: 00000000-00003552) "360se.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003552) "sgfeedbackhelper.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000b8d3750538cf8777dc38710324d475050100000090387103dc38710390387103040000000400000000e072770010000024d475050100000090387103cd9787779c978777f64f0387b50f6977903871030000877700000000d40efd710000000080ee6f770100000000000000f8e27277000000000400000080a91c7448407177f8e2727728d4750580e84475081a720380e8447524d475050000000080e8447550d475051b800800d8d475055806000078db7505642aed737e75ab39f30b0000faffffff90db7505000000001800000000000000e501f8d80000000000000000ffffffff0000000000000000000000008e237c03a4237c03 (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000007505d8d475051b800800cc5627008c020000000000000000000000000000b8d475051b80080040d5750558060000e0db750518000000e501f8d88c020000000000009f5727738c0200008c020000000000000000000000007505000000000000000018000000e0db750540d575051b8008008d01f8d850d375059f57277368d47505a01829733523a7aefeffffff78d47505222aed738c02000000000000000000000000000050d475051b800800d8d475055806000078db7505642aed737e75ab39f30b0000faffffff90db7505000000001800000000000000e501f8d80000000000000000ffffffff0000000000000000000000005e4e7c03764e7c03 (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000007505d8d475051b800800cc5627008c020000000000000000000000000000b8d475051b80080040d5750558060000e0db750518000000e501f8d88c020000000000009f5727738c0200008c020000000000000000000000007505000000000000000018000000e0db750540d575051b8008008d01f8d850d375059f57277368d47505a01829733523a7aefeffffff78d47505222aed738c02000000000000000000000000000050d475051b800800d8d475055806000078db7505642aed737e75ab39f30b0000faffffff90db7505000000001800000000000000e501f8d80000000000000000ffffffff0000000000000000000000002ea8770342a87703 (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000007505d8d475051b800800cc5627008c020000000000000000000000000000b8d475051b80080040d5750558060000e0db750518000000e501f8d88c020000000000009f5727738c0200008c020000000000000000000000007505000000000000000018000000e0db750540d575051b8008008d01f8d850d375059f57277368d47505a01829733523a7aefeffffff78d47505222aed738c02000000000000000000000000000050d475051b800800d8d475055806000078db7505642aed737e75ab39f30b0000faffffff90db7505000000001800000000000000e501f8d80000000000000000ffffffff0000000000000000000000006e227c0386227c03 (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000007505d8d475051b800800cc5627008c020000000000000000000000000000b8d475051b80080040d5750558060000e0db750518000000e501f8d88c020000000000009f5727738c0200008c020000000000000000000000007505000000000000000018000000e0db750540d575051b8008008d01f8d850d375059f57277368d47505a01829733523a7aefeffffff78d47505222aed738c02000000000000000000000000000050d475051b800800d8d475055806000078db7505642aed737e75ab39f30b0000faffffff90db7505000000001800000000000000e501f8d80000000000000000ffffffff00000000000000000000000076ffcd068cffcd06 (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000007505d8d475051b800800cc5627008c020000000000000000000000000000b8d475051b80080040d5750558060000e0db750518000000e501f8d88c020000000000009f5727738c0200008c020000000000000000000000007505000000000000000018000000e0db750540d575051b8008008d01f8d850d375059f57277368d47505a01829733523a7aefeffffff78d47505222aed738c02000000000000000000000000000050d475051b800800d8d475055806000078db7505642aed737e75ab39f30b0000faffffff90db7505000000001800000000000000e501f8d80000000000000000ffffffff00000000000000000000000076ffcd068effcd06 (UID: 00000000-00007764)3c:T464,"sgfeedbackhelper.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fe6c468448f4300600000000f8f73006506a8a772a77e4f5fefffffff9de8577a599687702100000000000000000000000100000000000000000000001000000a8f53006f9de8577 (UID: 00000000-00007764) "jzr.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e5ae0d8040fa150000000000e8fb1500506a8a7739bb8af7fefffffff9de8577a599687702100000000000000000000000100000000000000000000050dc4000f8fb1500f9de8577 (UID: 00000000-00007704) "jzr.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002b51f4c788f8b1000000000030fab100506a8a773f46d7b0fefffffff9de8577a599687702100000000000000000000000100000000000000000000050dc400040fab100f9de8577 (UID: 00000000-00001248)3d:T6a1,GetTickCount@KERNEL32.DLL at 00000000-00003552-49648-425-00942D7E GetTickCount@KERNEL32.DLL at 00000000-00007764-53975-1121-01072C70 GetTickCount@KERNEL32.DLL at 00000000-00007764-53975-1677-010734F0 GetTickCount@KERNEL32.DLL at 00000000-00007764-53975-1834-010736E0 GetTickCount@KERNEL32.DLL at 00000000-00007764-53975-2208-0106E3B0 GetTickCount@KERNEL32.DLL at 00000000-00007764-53975-2216-01070F70 GetTickCount@KERNEL32.DLL at 00000000-00007764-53975-2223-010739A0 GetTickCount@KERNEL32.DLL at 00000000-00007764-53975-2541-010CA630 GetTickCount@KERNEL32.DLL at 00000000-00007764-53975-2740-010C23E0 GetTickCount@KERNEL32.DLL at 00000000-00007764-53975-2942-010B0EA0 GetTickCount@KERNEL32.DLL at 00000000-00007764-53975-3534-01071F30 GetTickCount@KERNEL32.DLL at 00000000-00007764-53975-4157-00FDAEE0 GetTickCount@KERNEL32.DLL at 00000000-00007764-53975-5568-00FFB1A0 GetTickCount@KERNEL32.DLL at 00000000-00007764-53975-7756-010E2040 GetTickCount@KERNEL32.DLL at 00000000-00007764-53975-8904-01070683 GetTickCount@KERNEL32.DLL at 00000000-00003376-60889-1121-00E92C70 GetTickCount@KERNEL32.DLL at 00000000-00003376-60889-1677-00E934F0 GetTickCount@KERNEL32.DLL at 00000000-00003376-60889-1834-00E936E0 GetTickCount@KERNEL32.DLL at 00000000-00003376-60889-2208-00E8E3B0 GetTickCount@KERNEL32.DLL at 00000000-00003376-60889-2216-00E90F70 GetTickCount@KERNEL32.DLL at 00000000-00003376-60889-2223-00E939A0 GetTickCount@KERNEL32.DLL at 00000000-00003376-60889-2541-00EEA630 GetTickCount@KERNEL32.DLL at 00000000-00003376-60889-2740-00EE23E0 GetTickCount@KERNEL32.DLL at 00000000-00003376-60889-2942-00ED0EA0 GetTickCount@KERNEL32.DLL at 00000000-00003376-60889-3534-00E91F303e:T600,GetLocalTime@KERNEL32.DLL at 00000000-00003552-49648-55-009315F0 GetLocalTime@KERNEL32.DLL at 00000000-00003552-49648-430-00942BDF GetLocalTime@KERNEL32.DLL at 00000000-00003552-49648-437-00941CD0 GetLocalTime@KERNEL32.DLL at 00000000-00003552-49648-513-0093ACE0 GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003552-49648-1493-00945577 GetLocalTime@KERNEL32.DLL at 00000000-00007764-53975-2345-010CF5A5 GetLocalTime@KERNEL32.DLL at 00000000-00007764-53975-2361-010CEE0D GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007764-53975-3650-010F17C8 GetLocalTime@KERNEL32.DLL at 00000000-00007764-53975-4157-00FDAEE0 GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007764-53975-4272-010E53F6 GetLocalTime@KERNEL32.DLL at 00000000-00007764-53975-5568-00FFB1A0 GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007764-53975-7823-010E6A55 GetSystemTimePreciseAsFileTime@KERNEL32.DLL at 00000000-00007764-53975-10458-010E53B1 GetLocalTime@KERNEL32.DLL at 00000000-00003376-60889-2345-00EEF5A5 GetLocalTime@KERNEL32.DLL at 00000000-00003376-60889-2361-00EEEE0D GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003376-60889-3650-00F117C8 GetLocalTime@KERNEL32.DLL at 00000000-00003376-60889-4157-00DFAEE0 GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003376-60889-4272-00F053F6 GetLocalTime@KERNEL32.DLL at 00000000-00003376-60889-5568-00E1B1A0 GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003376-60889-7823-00F06A55 GetSystemTimePreciseAsFileTime@KERNEL32.DLL at 00000000-00003376-60889-10458-00F053B13f:T6be,GetUserDefaultLCID@KERNEL32.DLL at 00000000-00007764-53975-4089-011056B2 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00007764-53975-4096-0110506B GetLocaleInfoW@KERNEL32.DLL at 00000000-00007764-53975-4101-0110562E GetUserDefaultLCID@KERNEL32.DLL at 00000000-00007764-53975-4121-0110EF56 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00007764-53975-4122-0110E88D EnumSystemLocalesW@KERNEL32.DLL at 00000000-00007764-53975-4123-0110E973 GetLocaleInfoW@KERNEL32.DLL at 00000000-00007764-53975-4125-0110ED7A EnumSystemLocalesW@KERNEL32.DLL at 00000000-00007764-53975-4126-0110E8D8 GetLocaleInfoW@KERNEL32.DLL at 00000000-00007764-53975-7991-0110E7E8 GetLocaleInfoW@KERNEL32.DLL at 00000000-00007764-53975-7994-0110EA00 GetLocaleInfoW@KERNEL32.DLL at 00000000-00007764-53975-7995-0110EE80 GetLocaleInfoW@KERNEL32.DLL at 00000000-00007764-53975-7996-0110EC53 GetUserDefaultLCID@KERNEL32.DLL at 00000000-00003376-60889-4089-00F256B2 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00003376-60889-4096-00F2506B GetLocaleInfoW@KERNEL32.DLL at 00000000-00003376-60889-4101-00F2562E GetUserDefaultLCID@KERNEL32.DLL at 00000000-00003376-60889-4121-00F2EF56 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00003376-60889-4122-00F2E88D EnumSystemLocalesW@KERNEL32.DLL at 00000000-00003376-60889-4123-00F2E973 GetLocaleInfoW@KERNEL32.DLL at 00000000-00003376-60889-4125-00F2ED7A EnumSystemLocalesW@KERNEL32.DLL at 00000000-00003376-60889-4126-00F2E8D8 GetLocaleInfoW@KERNEL32.DLL at 00000000-00003376-60889-7991-00F2E7E8 GetLocaleInfoW@KERNEL32.DLL at 00000000-00003376-60889-7994-00F2EA00 GetLocaleInfoW@KERNEL32.DLL at 00000000-00003376-60889-7995-00F2EE80 GetLocaleInfoW@KERNEL32.DLL at 00000000-00003376-60889-7996-00F2EC5340:T51d,Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "360se.exe") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "360se.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "360se.exe") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; File: "360se.exe") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "360se.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001248.00000001.310177.010D8000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp")41:Td4e,Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "360se.exe") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "360se.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "360se.exe") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "360se.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "360se.exe") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "360se.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "360se.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "FindWindowExA" (Indicator: "FindWindow"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "3563579708,4576,105,,GetForegroundWindow,user32.dll,"01:20:12.234",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00003376.00000000.308171.05D82000.00000004.mdmp, 00000000-00003376.00000001.308317.05D82000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "FindWindowExA" (Indicator: "FindWindow"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp")42:T81f,Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; File: "360se.exe") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "360se.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "360se.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "360se.exe") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "360se.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "360se.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp")43:T6b7,GetProcessHeap@KERNEL32.DLL at 00000000-00003552-49648-2-00939290 GetProcessHeap@KERNEL32.DLL at 00000000-00003552-49648-7-009362C0 GetProcessHeap@KERNEL32.DLL at 00000000-00003552-49648-188-00962150 GetProcessHeap@KERNEL32.DLL at 00000000-00003552-49648-253-0095F7C0 GetProcessHeap@KERNEL32.DLL at 00000000-00003552-49648-631-00939200 GetProcessHeap@KERNEL32.DLL at 00000000-00003552-49648-632-009391A0 GetProcessHeap@KERNEL32.DLL at 00000000-00003552-49648-633-009390E0 GetProcessHeap@KERNEL32.DLL at 00000000-00003552-49648-756-00936220 GetProcessHeap@KERNEL32.DLL at 00000000-00003552-49648-758-00936160 GetProcessHeap@KERNEL32.DLL at 00000000-00003552-49648-772-009351F0 GetProcessHeap@KERNEL32.DLL at 00000000-00003552-49648-773-00934F30 GetProcessHeap@KERNEL32.DLL at 00000000-00003552-49648-784-00934BA0 GetProcessHeap@KERNEL32.DLL at 00000000-00003552-49648-802-00933E80 GetProcessHeap@KERNEL32.DLL at 00000000-00003552-49648-862-0092DC60 GetProcessHeap@KERNEL32.DLL at 00000000-00003552-49648-873-0092B9A0 GetProcessHeap@KERNEL32.DLL at 00000000-00003552-49648-887-0092AF40 GetProcessHeap@KERNEL32.DLL at 00000000-00003552-49648-921-00929ED0 GetProcessHeap@KERNEL32.DLL at 00000000-00003552-49648-932-009288A0 GetProcessHeap@KERNEL32.DLL at 00000000-00003552-49648-949-00927830 GetProcessHeap@KERNEL32.DLL at 00000000-00003552-49648-956-00925CF0 GetProcessHeap@KERNEL32.DLL at 00000000-00003552-49648-964-00925840 GetProcessHeap@KERNEL32.DLL at 00000000-00003552-49648-971-009252A0 OpenProcess@KERNEL32.DLL at 00000000-00003552-49648-1021-009164E0 GetProcessHeap@KERNEL32.DLL at 00000000-00003552-49648-1058-00923520 GetProcessHeap@KERNEL32.DLL at 00000000-00003552-49648-1070-0092207044:T629,"360se.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\SogouInput\E84C2983\abc\Microsoft\Windows\Start Menu\Programs\Startup (UID: 00000000-00003552) "360se.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\SogouInput\E84C2983\abc\Microsoft\Windows\Start Menu\Programs (UID: 00000000-00003552) "360se.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\SogouInput\E84C2983\abc\Microsoft\Windows\Start Menu (UID: 00000000-00003552) "360se.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\SogouInput\E84C2983\abc\Microsoft\Windows (UID: 00000000-00003552) "360se.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\SogouInput\E84C2983\abc\Microsoft (UID: 00000000-00003552) "360se.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\SogouInput\E84C2983\abc (UID: 00000000-00003552) "360se.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\SogouInput\E84C2983 (UID: 00000000-00003552) "360se.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\SogouInput (UID: 00000000-00003552) "360se.exe" called "CreateDirectoryW" with parameter %TEMP%\1770570338 (UID: 00000000-00003552) "360se.exe" called "CreateDirectoryW" with parameter %TEMP%\1770570338\....\ (UID: 00000000-00003552) "sgfeedbackhelper.exe" called "CreateDirectoryW" with parameter %TEMP%\LOG (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "CreateDirectoryW" with parameter %TEMP%\LOG\IME (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "CreateDirectoryW" with parameter %TEMP%\LOG\APP (UID: 00000000-00007764)45:T1c1e,"360se.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003552) "360se.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003552) "360se.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003552) "360se.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003552) "360se.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00003552) "360se.exe" called "LoadLibrary" with a parameter SHCore.dll (UID: 00000000-00003552) "360se.exe" called "LoadLibrary" with a parameter C:\Kernel32.dll (UID: 00000000-00003552) "360se.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00003552) "360se.exe" called "LoadLibrary" with a parameter advpack.dll (UID: 00000000-00003552) "360se.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003552) "360se.exe" called "LoadLibrary" with a parameter api-ms-win-security-systemfunctions-l1-1-0 (UID: 00000000-00003552) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter advpack.dll (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter api-ms-win-security-systemfunctions-l1-1-0 (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter Cryptdll.dll (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter Shcore.dll (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter PSAPI.DLL (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter DINPUT8.dll (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\SogouInput\E84C2983\HWSignature.dll (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter ext-ms-win-mininput-inputhost-l1-1-1.dll (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter ext-ms-win-mininput-inputhost-l1-1-0.dll (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter msdmo.dll (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "LoadLibrary" with a parameter avicap32.dll (UID: 00000000-00007764) "sgfeedbackhelperz.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "LoadLibrary" with a parameter advpack.dll (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00003376) "jzr.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007704) "jzr.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007704) "jzr.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007704) "jzr.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007704) "jzr.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001248) "jzr.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001248) "jzr.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001248) "jzr.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001248)46:Te356,"360se.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter GetDpiForMonitor (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter IsNTAdmin (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003552) "360se.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003552) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter IsNTAdmin (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter AddMandatoryAce (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CreateWaitableTimerA (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter IsBadReadPtr (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter OpenEventA (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter RtlMoveMemory (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetVersion (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter InterlockedDecrement (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter InterlockedIncrement (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter TlsSetValue (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter TlsFree (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter SetHandleCount (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetStartupInfoA (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsA (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetEnvironmentStrings (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableA (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter HeapDestroy (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter HeapCreate (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter LCMapStringA (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter LCMapStringW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetCPInfo (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetStringTypeA (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetStringTypeW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter SetStdHandle (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter FlushFileBuffers (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter PeekMessageA (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter DispatchMessageA (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter wsprintfA (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter MsgWaitForMultipleObjects (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter MD5Init (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter MD5Update (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter MD5Final (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetLogicalDriveStringsW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CreateRemoteThread (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetLocaleInfoW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter lstrcmpW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter VirtualProtectEx (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetProcessId (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter QueryDosDeviceW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter lstrcatW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter lstrcpyW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GlobalSize (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GlobalLock (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableA (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CompareStringW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter IsValidLocale (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter EnumSystemLocalesA (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetLocaleInfoA (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetUserDefaultLCID (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter IsValidCodePage (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CreateWaitableTimerW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter TryEnterCriticalSection (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CancelIo (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter InterlockedExchange (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter lstrcmpiW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter InterlockedCompareExchange (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter ExitThread (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter HeapSize (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GlobalUnlock (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetLastInputInfo (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter wsprintfW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CloseClipboard (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter ExitWindowsEx (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter OpenClipboard (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetClipboardData (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetProcessDpiAwarenessInternal (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetDpiForMonitor (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CreateDIBSection (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter StretchBlt (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter SetDIBColorTable (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter SetStretchBltMode (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CloseEventLog (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter ClearEventLogW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter RegCreateKeyW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter OpenEventLogW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetCurrentHwProfileW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetHGlobalFromStream (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter WSAResetEvent (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter WSAWaitForMultipleEvents (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter WSACloseEvent (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter WSAEnumNetworkEvents (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter WSACreateEvent (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter IUnknown_QueryService (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter timeGetTime (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GdipGetImageHeight (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GdipFree (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GdipSaveImageToStream (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GdiplusShutdown (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GdipGetImageWidth (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GdipCloneImage (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GdipBitmapLockBits (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GdipGetImagePaletteSize (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GdipGetImageEncoders (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromHBITMAP (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GdipGetImageEncodersSize (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GdipAlloc (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GdipDrawImageI (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GdipBitmapUnlockBits (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GdipGetImageGraphicsContext (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromScan0 (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GdipGetImagePixelFormat (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromStream (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GdipGetImagePalette (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CreateDXGIFactory (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter ChangeWindowMessageFilter (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GetProcessImageFileNameW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter MsgWaitForMultipleObjectsEx (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter DirectInput8Create (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CreateInputHostForProcess (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter GenHWID (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter CreateGenericInputHost (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter SetupDiGetClassDevsW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter SetupDiDestroyDeviceInfoList (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter SetupDiEnumDeviceInterfaces (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter SetupDiOpenDeviceInterfaceRegKey (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter SetupDiCreateDeviceInterfaceRegKeyW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter SetupDiGetDeviceInterfaceDetailW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter SetupDiCreateDeviceInfoList (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter SetupDiOpenDeviceInterfaceW (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter SetupDiGetDeviceInterfaceAlias (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter DMOEnum (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter DMOGetTypes (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter DMOGetName (UID: 00000000-00007764) "sgfeedbackhelper.exe" called "GetProcAddress" with a parameter capGetDriverDescriptionW (UID: 00000000-00007764) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter IsNTAdmin (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter NtReadVirtualMemory (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter NtProtectVirtualMemory (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter NtAllocateVirtualMemory (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter NtResumeThread (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter NtClose (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003376) "sgfeedbackhelperz.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00003376) "jzr.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00007704) "jzr.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00001248) "jzr.exe" called "GetProcAddress" with a parameter strlen (UID: 00000000-00001248)47:T492,Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "360se.exe") Found reference to API "CreateFileVersionInfoWin" (Indicator: "CreateFile"; File: "360se.exe") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; File: "360se.exe") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; File: "360se.exe") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; File: "360se.exe") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "360se.exe") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp")48:T698,WaitForSingleObject@KERNEL32.DLL at 00000000-00003552-49648-55-009315F0 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00003552-49648-783-009449CC WaitForSingleObject@KERNEL32.DLL at 00000000-00003552-49648-815-00931EE0 WaitForSingleObject@KERNEL32.DLL at 00000000-00003552-49648-816-00931BA0 WaitForSingleObject@KERNEL32.DLL at 00000000-00003552-49648-938-009281C0 MsgWaitForMultipleObjects at 00000000-00003552-49648-954-00927540 MsgWaitForMultipleObjects at 00000000-00003552-49648-1005-00916AE0 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00007764-53975-385-010E58C7 SetTimer at 00000000-00007764-53975-1711-010DD680 SetTimer at 00000000-00007764-53975-2693-01073E40 SetTimer at 00000000-00007764-53975-2975-010AAFF0 Sleep@KERNEL32.DLL at 00000000-00007764-53975-3640-0101FE10 Sleep@KERNEL32.DLL at 00000000-00007764-53975-4016-00FE5A90 Sleep@KERNEL32.DLL at 00000000-00007764-53975-4532-010115E0 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00007764-53975-4570-01054780 WaitForSingleObject@KERNEL32.DLL at 00000000-00007764-53975-4571-0100CE70 WaitForSingleObject@KERNEL32.DLL at 00000000-00007764-53975-4618-01053290 Sleep@KERNEL32.DLL at 00000000-00007764-53975-4828-01033030 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00007764-53975-5098-010E494E WaitForSingleObject@KERNEL32.DLL at 00000000-00007764-53975-5169-0102BE30 WaitForSingleObject@KERNEL32.DLL at 00000000-00007764-53975-5429-01015620 Sleep@KERNEL32.DLL at 00000000-00007764-53975-5839-00FD5BF0 WaitForSingleObject@KERNEL32.DLL at 00000000-00007764-53975-7317-01053190 SetTimer at 00000000-00007764-53975-7318-01053550 MsgWaitForMultipleObjectsEx at 00000000-00007764-53975-7320-0105373049:T6ab,LoadLibraryExW@KERNEL32.DLL at 00000000-00003552-49648-416-00947527 LoadLibraryW@KERNEL32.DLL at 00000000-00003552-49648-739-00937840 LoadLibraryW@KERNEL32.DLL at 00000000-00003552-49648-998-00923C00 LoadLibraryW@KERNEL32.DLL at 00000000-00003552-49648-1001-0091BC00 LoadLibraryExW@KERNEL32.DLL at 00000000-00003552-49648-2013-00952374 LoadLibraryW@KERNEL32.DLL at 00000000-00007764-53975-1451-0106ABB0 LoadLibraryW@KERNEL32.DLL at 00000000-00007764-53975-2288-010AA220 LoadLibraryW@KERNEL32.DLL at 00000000-00007764-53975-3092-010A66A0 LoadLibraryW@KERNEL32.DLL at 00000000-00007764-53975-3471-0106A400 LoadLibraryExW@KERNEL32.DLL at 00000000-00007764-53975-3598-01068190 LoadLibraryW@KERNEL32.DLL at 00000000-00007764-53975-3906-01012810 LoadLibraryW@KERNEL32.DLL at 00000000-00007764-53975-4281-0105D680 LoadLibraryW@KERNEL32.DLL at 00000000-00007764-53975-5189-01009C60 LoadLibraryW@KERNEL32.DLL at 00000000-00007764-53975-5567-00FFB6A0 LoadLibraryExW@KERNEL32.DLL at 00000000-00007764-53975-7869-010EB212 LoadLibraryW@KERNEL32.DLL at 00000000-00003376-60889-1451-00E8ABB0 LoadLibraryW@KERNEL32.DLL at 00000000-00003376-60889-2288-00ECA220 LoadLibraryW@KERNEL32.DLL at 00000000-00003376-60889-3092-00EC66A0 LoadLibraryW@KERNEL32.DLL at 00000000-00003376-60889-3471-00E8A400 LoadLibraryExW@KERNEL32.DLL at 00000000-00003376-60889-3598-00E88190 LoadLibraryW@KERNEL32.DLL at 00000000-00003376-60889-3906-00E32810 LoadLibraryW@KERNEL32.DLL at 00000000-00003376-60889-4281-00E7D680 LoadLibraryW@KERNEL32.DLL at 00000000-00003376-60889-5189-00E29C60 LoadLibraryW@KERNEL32.DLL at 00000000-00003376-60889-5567-00E1B6A0 LoadLibraryExW@KERNEL32.DLL at 00000000-00003376-60889-7869-00F0B2124a:T57b,Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "360se.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "360se.exe") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "360se.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "360se.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "360se.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp")4b:T4bf,Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "360se.exe") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "360se.exe") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; File: "360se.exe") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001248.00000001.310177.010D8000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp")4c:T971,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "360se.exe") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; File: "360se.exe") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "360se.exe") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "360se.exe") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "360se.exe") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; File: "360se.exe") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThread"; File: "360se.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "360se.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "Wow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00003376.00000001.308317.732F9000.00000002.mdmp")4d:T6a3,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "360se.exe") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; File: "360se.exe") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "360se.exe") Found reference to API "NtOpenProcess" (Indicator: "OpenProcess"; File: "360se.exe") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcess"; File: "360se.exe") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcess"; File: "360se.exe") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp, 00000000-00001248.00000001.310177.010D8000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00001248.00000001.310177.010D8000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp")4e:T45c,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "360se.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "360se.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp, 00000000-00001248.00000001.310177.010D8000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp")4f:T47b,Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; File: "360se.exe") Found reference to API "ShowWindowAsync" (Indicator: "ShowWindow"; File: "360se.exe") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; File: "360se.exe") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp")50:Tfd4,"\abc\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "\abc\microsoft\windows\start menu\programs\startup") in Source: 360se.exe "abc\Microsoft\Windows\Start Menu\Programs\Startup\" (Indicator: "abc\microsoft\windows\start menu\programs\startup\") in Source: 360se.exe "%PROGRAMFILES%\SogouInput\E84C2983\abc\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "%programfiles%\sogouinput\e84c2983\abc\microsoft\windows\start menu\programs\startup") in Source: 00000000-00003552-00000C3F-1789059042 "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\\FaCveHBxN*.*" (Indicator: "%appdata%\microsoft\windows\start menu\programs\startup\\facvehbxn*.*") in Source: 00000000-00001248-00000C2D-3984492958 ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001248.00000000.308256.00F40000.00000004.mdmp 00000000-00001248.00000001.310177.00F40000.00000004.mdmp 00000000-00001248.00000002.312096.00F40000.00000004.mdmp "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\") in Source: 00000000-00001248.00000000.308256.00F40000.00000004.mdmp 00000000-00001248.00000001.310177.00F40000.00000004.mdmp 00000000-00001248.00000002.312096.00F40000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\") in Source: 00000000-00001248.00000000.308256.00F40000.00000004.mdmp 00000000-00001248.00000001.310177.00F40000.00000004.mdmp 00000000-00001248.00000002.312096.00F40000.00000004.mdmp "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\facvehbxnghtyxp.lnkbocaffc" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\facvehbxnghtyxp.lnkbocaffc") in Source: 00000000-00001248.00000000.308256.00F40000.00000004.mdmp 00000000-00001248.00000001.310177.00F40000.00000004.mdmp 00000000-00001248.00000002.312096.00F40000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FaCveHBxN<"*" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\facvehbxn<"*") in Source: 00000000-00001248.00000000.308256.00F40000.00000004.mdmp 00000000-00001248.00000001.310177.00F40000.00000004.mdmp 00000000-00001248.00000002.312096.00F40000.00000004.mdmp "sers\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\\FaCveHBxN*.*" (Indicator: "sers\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\\facvehbxn*.*") in Source: 00000000-00001248.00000000.308256.00F40000.00000004.mdmp 00000000-00001248.00000001.310177.00F40000.00000004.mdmp 00000000-00001248.00000002.312096.00F40000.00000004.mdmp "\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\\FaCveHBxN*.*" (Indicator: "\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\\facvehbxn*.*") in Source: 00000000-00001248.00000000.308256.00F40000.00000004.mdmp 00000000-00001248.00000001.310177.00F40000.00000004.mdmp 00000000-00001248.00000002.312096.00F40000.00000004.mdmp "\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\\" (Indicator: "\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\\") in Source: 00000000-00001248.00000000.308256.00F40000.00000004.mdmp 00000000-00001248.00000001.310177.00F40000.00000004.mdmp 00000000-00001248.00000002.312096.00F40000.00000004.mdmp "\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" (Indicator: "\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\") in Source: 00000000-00001248.00000000.308256.00F40000.00000004.mdmp 00000000-00001248.00000001.310177.00F40000.00000004.mdmp 00000000-00001248.00000002.312096.00F40000.00000004.mdmp51:T1500,"Software\360Safe\Liveup" in Source: 360se.exe "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA" in Source: 360se.exe "SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware" in Source: 360se.exe "Software\360\360se6\Chrome" in Source: 360se.exe "Software\360\360se6\default" in Source: 360se.exe "software\360\360se6" in Source: 360se.exe "Software\360\360se6\Update\ClientState\{02E720BD-2B50-4404-947C-65DBE64F6970}" in Source: 360se.exe "Software\360" in Source: 360se.exe "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe" in Source: 360se.exe "Software\360\360se6\Update\Clients\{02E720BD-2B50-4404-947C-65DBE64F6970}" in Source: 360se.exe "Software\Classes\http\shell\open\command" in Source: 360se.exe "Software\Microsoft\Windows\shell\Associations\UrlAssociations\http\UserChoice" in Source: 360se.exe "Software\Microsoft\Windows\CurrentVersion\App Paths\360se6.exe" in Source: 360se.exe "SOFTWARE\Hintsoft\PubwinClient" in Source: 360se.exe "SOFTWARE\Sicent\wx2004Clt" in Source: 360se.exe "SOFTWARE\Goyoo\i8desk" in Source: 360se.exe "SOFTWARE\EYOOCLIENTSTATUS" in Source: 360se.exe "SYSTEM\CurrentControlSet\Services\STVDISKX" in Source: 360se.exe "SOFTWARE\iCafe8" in Source: 360se.exe "SOFTWARE\Hintsoft1\XunShanPro" in Source: 360se.exe "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 360se.exe "SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards" in Source: 360se.exe "Software\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE" in Source: 360se.exe "SOFTWARE\DTLSoft\DriveTheLife" in Source: 360se.exe "SOFTWARE\DTLSoft\DriveTheLife2013" in Source: 360se.exe "SOFTWARE\Huorong\Sysdiag" in Source: 360se.exe "SOFTWARE\kingsoft\Antivirus" in Source: 360se.exe "Software\Tencent\QQPCMgr" in Source: 360se.exe "Software\WOW6432Node\Tencent\QQPCMgr" in Source: 360se.exe "SOFTWARE\MyDrivers\DriverGenius" in Source: 360se.exe "software\2345pcsafe" in Source: 360se.exe "Software\WOW6432Node\2345pcsafe" in Source: 360se.exe "software\LENOVO\PCMANAGER" in Source: 360se.exe "Software\WOW6432Node\LENOVO\PCMANAGER" in Source: 360se.exe "SOFTWARE\liebao" in Source: 360se.exe "SOFTWARE\WOW6432Node\liebao" in Source: 360se.exe "software\SogouExplorer" in Source: 360se.exe "SOFTWARE\Tencent\QQBrowser" in Source: 360se.exe "SOFTWARE\WOW6432Node\Tencent\QQBrowser" in Source: 360se.exe "software\2345explorer" in Source: 360se.exe "SOFTWARE\WOW6432Node\2345explorer" in Source: 360se.exe "software\lenovo\slbrowser" in Source: 360se.exe "SOFTWARE\WOW6432Node\lenovo\slbrowser" in Source: 360se.exe "SOFTWARE\360MachineSignature" in Source: 360se.exe ":SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards" in Source: 360se.exe "RSoftware\360\360se6\Chrome" in Source: 360se.exe "Software\SogouInput" in Source: 53975-393-010182A0 "Software\SogouInput.store.user" in Source: 53975-3955-01002DC0 "Software\Microsoft\Windows\Shell\Associations\UrlAssociations\" in Source: 53975-5351-01020230 "Software\Classes\" in Source: 53975-5352-010204D0 "Software\Microsoft\Windows\CurrentVersion" in Source: 53975-5476-0100EAC0 "SoftWare\SogouExtension" in Source: 53975-5483-01009FE0 "Software\Microsoft\Windows\CurrentVersion\Diagnostics\PerfTrack\TraceProfile" in Source: 1477-41-010D34D0 "Software\Microsoft\Windows NT\CurrentVersion\Svchost" in Source: 1477-48-010D33C0 "System\CurrentControlSet\Services" in Source: 1477-56-010D2380 "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\" in Source: 00000000-00001248.00000001.310177.00400000.00000040.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00003376.00000000.308171.03810000.00000004.mdmp 00000000-00003376.00000001.308317.03810000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\" in Source: 00000000-00003376.00000000.308171.05E82000.00000004.mdmp 00000000-00003376.00000001.308317.05E82000.00000004.mdmp "Software\SogouInput" in Source: 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp "Software\SogouInput.store.user" in Source: 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp "Software\SogouInput.tc" in Source: 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp "SoftWare\SogouExtension" in Source: 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp "Software\SogouInput\VerifySign" in Source: 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp "Software\Microsoft\Windows\Shell\Associations\UrlAssociations\" in Source: 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp "Software\Classes\" in Source: 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA" in Source: 00000000-00003376.00000001.308317.732F9000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware" in Source: 00000000-00003376.00000001.308317.732F9000.00000002.mdmp52:T4d7,"360se.exe" with parameter %PROGRAMFILES%\SogouInput\E84C2983\abc\Microsoft\Windows\Start Menu\Programs\Startup (UID: 00000000-00003552) "360se.exe" with parameter %PROGRAMFILES%\SogouInput\E84C2983\abc\Microsoft\Windows\Start Menu\Programs (UID: 00000000-00003552) "360se.exe" with parameter %PROGRAMFILES%\SogouInput\E84C2983\abc\Microsoft\Windows\Start Menu (UID: 00000000-00003552) "360se.exe" with parameter %PROGRAMFILES%\SogouInput\E84C2983\abc\Microsoft\Windows (UID: 00000000-00003552) "360se.exe" with parameter %PROGRAMFILES%\SogouInput\E84C2983\abc\Microsoft (UID: 00000000-00003552) "360se.exe" with parameter %PROGRAMFILES%\SogouInput\E84C2983\abc (UID: 00000000-00003552) "360se.exe" with parameter %PROGRAMFILES%\SogouInput\E84C2983 (UID: 00000000-00003552) "360se.exe" with parameter %PROGRAMFILES%\SogouInput (UID: 00000000-00003552) "360se.exe" with parameter %TEMP%\1770570338 (UID: 00000000-00003552) "360se.exe" with parameter %TEMP%\1770570338\....\ (UID: 00000000-00003552) "sgfeedbackhelper.exe" with parameter %TEMP%\LOG (UID: 00000000-00007764) "sgfeedbackhelper.exe" with parameter %TEMP%\LOG\IME (UID: 00000000-00007764) "sgfeedbackhelper.exe" with parameter %TEMP%\LOG\APP (UID: 00000000-00007764)53:T843,Process 360se.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3552:168:WilStaging_02" Process 360se.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3552:64:WilError_01" Process 360se.exe created mutex with name "Local\SM0:3552:168:WilStaging_02" Process 360se.exe created mutex with name "SM0:3552:64:WilError_01" Process sgfeedbackhelper.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7764:168:WilStaging_02" Process sgfeedbackhelper.exe created mutex with name "\Sessions\1\BaseNamedObjects\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001" Process sgfeedbackhelper.exe created mutex with name "eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001" Process sgfeedbackhelper.exe created mutex with name "Local\SM0:7764:64:WilError_01" Process sgfeedbackhelper.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process sgfeedbackhelper.exe created mutex with name "Local\SM0:7764:168:WilStaging_02" Process sgfeedbackhelper.exe created mutex with name "2026. 2. 6" Process sgfeedbackhelper.exe created mutex with name "SM0:7764:64:WilError_01" Process sgfeedbackhelper.exe created mutex with name "Local\ZonesCacheCounterMutex" Process sgfeedbackhelper.exe created mutex with name "sgime_user_lock" Process sgfeedbackhelper.exe created mutex with name "\Sessions\1\BaseNamedObjects\2026. 2. 6" Process sgfeedbackhelper.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process sgfeedbackhelper.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7764:64:WilError_01" Process sgfeedbackhelper.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process sgfeedbackhelper.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process sgfeedbackhelper.exe created mutex with name "\Sessions\1\BaseNamedObjects\sgime_user_lock" Process sgfeedbackhelper.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7764:64:WilError_01"54:T2f38,"Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\" in Source: 00000000-00001248.00000001.310177.00400000.00000040.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00003376.00000000.308171.03810000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\" in Source: 00000000-00003376.00000000.308171.05E82000.00000004.mdmp "Software\SogouInput" in Source: 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp "Software\SogouInput.store.user" in Source: 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp "Software\SogouInput.tc" in Source: 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp "SoftWare\SogouExtension" in Source: 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp "Software\SogouInput\VerifySign" in Source: 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp "Software\Microsoft\Windows\Shell\Associations\UrlAssociations\" in Source: 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp "Software\Classes\" in Source: 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00003376.00000001.308317.03810000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\" in Source: 00000000-00003376.00000001.308317.05E82000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA" in Source: 00000000-00003376.00000001.308317.732F9000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware" in Source: 00000000-00003376.00000001.308317.732F9000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA" in Source: 00000000-00003552.00000001.307698.00963000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware" in Source: 00000000-00003552.00000001.307698.00963000.00000002.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00003552.00000001.307698.039D0000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003552.00000001.307698.039D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\" in Source: 00000000-00007704.00000000.308255.00400000.00000040.mdmp "System\CurrentControlSet\Services" in Source: 00000000-00007704.00000000.308255.010D1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Diagnostics\PerfTrack\TraceProfile" in Source: 00000000-00007704.00000000.308255.010D1000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007764.00000000.307984.0112B000.00000002.mdmp "Software\SogouInput.store.user" in Source: 00000000-00007764.00000000.307984.0112B000.00000002.mdmp "Software\SogouInput.tc" in Source: 00000000-00007764.00000000.307984.0112B000.00000002.mdmp "SoftWare\SogouExtension" in Source: 00000000-00007764.00000000.307984.0112B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00007764.00000000.307984.0112B000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00007764.00000000.307984.0112B000.00000002.mdmp "Software\SogouInput\VerifySign" in Source: 00000000-00007764.00000000.307984.0112B000.00000002.mdmp "Software\Microsoft\Windows\Shell\Associations\UrlAssociations\" in Source: 00000000-00007764.00000000.307984.0112B000.00000002.mdmp "Software\Classes\" in Source: 00000000-00007764.00000000.307984.0112B000.00000002.mdmp "Software\Wow6432`" in Source: 00000000-00007764.00000000.307984.03710000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00007764.00000000.307984.03710000.00000004.mdmp "Software\Wow6432 " in Source: 00000000-00007764.00000000.307984.03710000.00000004.mdmp "sSoftware\Wow6432 " in Source: 00000000-00007764.00000000.307984.03710000.00000004.mdmp "y\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00007764.00000000.307984.03710000.00000004.mdmp "ACHINE\Software\SogouInput" in Source: 00000000-00007764.00000000.307984.03710000.00000004.mdmp "Software\Tencent\Plugin\VAS" in Source: 00000000-00007764.00000000.307984.06463000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007764.00000000.307984.06463000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00007764.00000000.307984.06463000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007764.00000000.307984.06463000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" in Source: 00000000-00007764.00000000.307984.06463000.00000004.mdmp "Software\Tencent\Plugin\VAS" in Source: 00000000-00007764.00000000.307984.065A7000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007764.00000000.307984.065A7000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00007764.00000000.307984.065A7000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007764.00000000.307984.065A7000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" in Source: 00000000-00007764.00000000.307984.065A7000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007764.00000000.307984.06CA0000.00000004.mdmp "Software\Tencent\Plugin\VAS" in Source: 00000000-00007764.00000000.307984.06CA0000.00000004.mdmp "stry\Machine\Software\Classes\Wow6432Node\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\Instance" in Source: 00000000-00007764.00000000.307984.06CA0000.00000004.mdmp "Registry\Machine\Software\Classes\Applications\sgfeedbackhelperz.exe" in Source: 00000000-00007764.00000000.307984.06CA0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007764.00000000.307984.06CA0000.00000004.mdmp "Software\Wow6432`" in Source: 00000000-00007764.00000001.309906.03710000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00007764.00000001.309906.03710000.00000004.mdmp "Software\Wow6432 " in Source: 00000000-00007764.00000001.309906.03710000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Drivers32" in Source: 00000000-00007764.00000001.309906.03710000.00000004.mdmp "sSoftware\Wow6432 " in Source: 00000000-00007764.00000001.309906.03710000.00000004.mdmp "y\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00007764.00000001.309906.03710000.00000004.mdmp "ACHINE\Software\SogouInput" in Source: 00000000-00007764.00000001.309906.03710000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007764.00000001.309906.06C2C000.00000002.mdmp "Software\Tencent\Plugin\VAS" in Source: 00000000-00007764.00000001.309906.06C2C000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007764.00000001.309906.06CA0000.00000004.mdmp "Software\Tencent\Plugin\VAS" in Source: 00000000-00007764.00000001.309906.06CA0000.00000004.mdmp "Registry\Machine\Software\Classes\Applications\sgfeedbackhelperz.exe" in Source: 00000000-00007764.00000001.309906.06CA0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007764.00000001.309906.06CA0000.00000004.mdmp "Software\Tencent\Plugin\VAS" in Source: 00000000-00007764.00000001.309906.10000000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007764.00000001.309906.10000000.00000040.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00007764.00000001.309906.10000000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007764.00000001.309906.10000000.00000040.mdmp "SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" in Source: 00000000-00007764.00000001.309906.10000000.00000040.mdmp "Software\Wow6432`" in Source: 00000000-00007764.00000002.311825.03710000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00007764.00000002.311825.03710000.00000004.mdmp "Software\Wow6432 " in Source: 00000000-00007764.00000002.311825.03710000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Drivers32" in Source: 00000000-00007764.00000002.311825.03710000.00000004.mdmp "sSoftware\Wow6432 " in Source: 00000000-00007764.00000002.311825.03710000.00000004.mdmp "y\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00007764.00000002.311825.03710000.00000004.mdmp "ACHINE\Software\SogouInput" in Source: 00000000-00007764.00000002.311825.03710000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007764.00000002.311825.06CA0000.00000004.mdmp "Software\Tencent\Plugin\VAS" in Source: 00000000-00007764.00000002.311825.06CA0000.00000004.mdmp "Registry\Machine\Software\Classes\Applications\sgfeedbackhelperz.exe" in Source: 00000000-00007764.00000002.311825.06CA0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007764.00000002.311825.06CA0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\" in Source: 00000000-00007764.00000002.311825.72661000.00000002.mdmp "Software\GSettings" in Source: 00000000-00007764.00000002.311825.72661000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00007764.00000002.311825.72661000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007764.00000002.311825.72661000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\TimeZoneInformation" in Source: 00000000-00007764.00000002.311825.72661000.00000002.mdmp "HKEY_CLASSES_ROOT\" in Source: 00000000-00007764.00000002.311825.72661000.00000002.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\" in Source: 00000000-00007764.00000002.311825.72661000.00000002.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\" in Source: 00000000-00007764.00000002.311825.72661000.00000002.mdmp "HKEY_CURRENT_USER\Software\Clients" in Source: 00000000-00007764.00000002.311825.72661000.00000002.mdmp "HKEY_LOCAL_MACHINE\Software\Clients" in Source: 00000000-00007764.00000002.311825.72661000.00000002.mdmp "HKEY_CURRENT_USER\Software\RegisteredApplications" in Source: 00000000-00007764.00000002.311825.72661000.00000002.mdmp "HKEY_LOCAL_MACHINE\Software\RegisteredApplications" in Source: 00000000-00007764.00000002.311825.72661000.00000002.mdmp "HKEY_LOCAL_MACHINE\" in Source: 00000000-00007764.00000002.311825.72661000.00000002.mdmp "HKEY_CLASSES_ROOT\Applications" in Source: 00000000-00007764.00000002.311825.72661000.00000002.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations" in Source: 00000000-00007764.00000002.311825.72661000.00000002.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" in Source: 00000000-00007764.00000002.311825.72661000.00000002.mdmp "HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00007764.00000002.311825.72661000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink" in Source: 00000000-00007764.00000002.311825.72661000.00000002.mdmp55:T230f,"360se.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77580000 "360se.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77580000 "360se.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77580000 "360se.exe" loaded module "KERNEL32" at base 77760000 "360se.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73200000 "360se.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 77580000 "360se.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d00000 "360se.exe" loaded module "SHCORE.DLL" at base 74920000 "360se.exe" loaded module "C:\KERNEL32.DLL" at base 0 "360se.exe" loaded module "KERNEL32.DLL" at base 77760000 "360se.exe" loaded module "ADVPACK.DLL" at base 731d0000 "360se.exe" loaded module "ADVAPI32.DLL" at base 74f10000 "360se.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 74f10000 "360se.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 742a0000 "360se.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 75330000 "360se.exe" loaded module "NTDLL.DLL" at base 77830000 "360se.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 737a0000 "360se.exe" loaded module "RPCRT4.DLL" at base 74550000 "360se.exe" loaded module "CSCAPI.DLL" at base 734d0000 "360se.exe" loaded module "SHELL32.DLL" at base 76240000 "360se.exe" loaded module "%WINDIR%\SYSWOW64\DLNASHEXT.DLL" at base 73060000 "360se.exe" loaded module "%WINDIR%\SYSTEM32\PLAYTODEVICE.DLL" at base 73010000 "360se.exe" loaded module "%WINDIR%\SYSTEM32\DEVDISPITEMPROVIDER.DLL" at base 72ff0000 "360se.exe" loaded module "%WINDIR%\SYSTEM32\MMDEVAPI.DLL" at base 72f90000 "360se.exe" loaded module "%WINDIR%\SYSTEM32\WPDSHEXT.DLL" at base 72db0000 "360se.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 75330000 "360se.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 72ad0000 "360se.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 741a0000 "sgfeedbackhelper.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77580000 "sgfeedbackhelper.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77580000 "sgfeedbackhelper.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77580000 "sgfeedbackhelper.exe" loaded module "KERNEL32" at base 77760000 "sgfeedbackhelper.exe" loaded module "ADVPACK.DLL" at base 731c0000 "sgfeedbackhelper.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 731f0000 "sgfeedbackhelper.exe" loaded module "ADVAPI32.DLL" at base 74f10000 "sgfeedbackhelper.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 77580000 "sgfeedbackhelper.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 77580000 "sgfeedbackhelper.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 77580000 "sgfeedbackhelper.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 77580000 "sgfeedbackhelper.exe" loaded module "KERNEL32.DLL" at base 77760000 "sgfeedbackhelper.exe" loaded module "RPCRT4.DLL" at base 74550000 "sgfeedbackhelper.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76240000 "sgfeedbackhelper.exe" loaded module "COMCTL32.DLL" at base 728b0000 "sgfeedbackhelper.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 74f10000 "sgfeedbackhelper.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 742a0000 "sgfeedbackhelper.exe" loaded module "USER32.DLL" at base 75b20000 "sgfeedbackhelper.exe" loaded module "NTDLL.DLL" at base 77830000 "sgfeedbackhelper.exe" loaded module "OLEAUT32.DLL" at base 75a80000 "sgfeedbackhelper.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 737a0000 "sgfeedbackhelper.exe" loaded module "CRYPTDLL.DLL" at base 73170000 "sgfeedbackhelper.exe" loaded module "MSIMG32.DLL" at base 728a0000 "sgfeedbackhelper.exe" loaded module "SHELL32.DLL" at base 76240000 "sgfeedbackhelper.exe" loaded module "GDI32.DLL" at base 74270000 "sgfeedbackhelper.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 73f90000 "sgfeedbackhelper.exe" loaded module "SHCORE.DLL" at base 74920000 "sgfeedbackhelper.exe" loaded module "OLE32.DLL" at base 74ae0000 "sgfeedbackhelper.exe" loaded module "%WINDIR%\SYSWOW64\IEFRAME.DLL" at base 710b0000 "sgfeedbackhelper.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73060000 "sgfeedbackhelper.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 74920000 "sgfeedbackhelper.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 76240000 "sgfeedbackhelper.exe" loaded module "WS2_32.DLL" at base 74820000 "sgfeedbackhelper.exe" loaded module "WINMM.DLL" at base 72810000 "sgfeedbackhelper.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77760000 "sgfeedbackhelper.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73b40000 "sgfeedbackhelper.exe" loaded module "URLMON.DLL" at base 73b40000 "sgfeedbackhelper.exe" loaded module "MSISO.DLL" at base 73000000 "sgfeedbackhelper.exe" loaded module "SSPICLI.DLL" at base 74250000 "sgfeedbackhelper.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 77580000 "sgfeedbackhelper.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 75330000 "sgfeedbackhelper.exe" loaded module "GDIPLUS.DLL" at base 73f90000 "sgfeedbackhelper.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 741a0000 "sgfeedbackhelper.exe" loaded module "DXGI.DLL" at base 72f60000 "sgfeedbackhelper.exe" loaded module "PSAPI.DLL" at base 759e0000 "sgfeedbackhelper.exe" loaded module "DINPUT8.DLL" at base 72f20000 "sgfeedbackhelper.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 75210000 "sgfeedbackhelper.exe" loaded module "%PROGRAMFILES%\SOGOUINPUT\E84C2983\HWSIGNATURE.DLL" at base 732c0000 "sgfeedbackhelper.exe" loaded module "EXT-MS-WIN-MININPUT-INPUTHOST-L1-1-1.DLL" at base 72ef0000 "sgfeedbackhelper.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 75b20000 "sgfeedbackhelper.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74300000 "sgfeedbackhelper.exe" loaded module "EXT-MS-WIN-MININPUT-INPUTHOST-L1-1-0.DLL" at base 72ef0000 "sgfeedbackhelper.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73410000 "sgfeedbackhelper.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 72b30000 "sgfeedbackhelper.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 72b10000 "sgfeedbackhelper.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 72af0000 "sgfeedbackhelper.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 72ae0000 "sgfeedbackhelper.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 721a0000 "sgfeedbackhelper.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72ad0000 "sgfeedbackhelper.exe" loaded module "EXT-MS-WIN-CORE-RESOURCEPOLICY-L1-1-0.DLL" at base 72180000 "sgfeedbackhelper.exe" loaded module "%WINDIR%\SYSWOW64\DEVENUM.DLL" at base 72180000 "sgfeedbackhelper.exe" loaded module "SETUPAPI.DLL" at base 75e10000 "sgfeedbackhelper.exe" loaded module "MSDMO.DLL" at base 72170000 "sgfeedbackhelper.exe" loaded module "AVICAP32.DLL" at base 72150000 "sgfeedbackhelper.exe" loaded module "WINDOWSCODECS.DLL" at base 71c20000 "sgfeedbackhelperz.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77580000 "sgfeedbackhelperz.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77580000 "sgfeedbackhelperz.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77580000 "sgfeedbackhelperz.exe" loaded module "KERNEL32" at base 77760000 "sgfeedbackhelperz.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 731f0000 "sgfeedbackhelperz.exe" loaded module "ADVPACK.DLL" at base 72170000 "sgfeedbackhelperz.exe" loaded module "ADVAPI32.DLL" at base 74f10000 "sgfeedbackhelperz.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 742a0000 "sgfeedbackhelperz.exe" loaded module "NTDLL.DLL" at base 77830000 "sgfeedbackhelperz.exe" loaded module "KERNEL32.DLL" at base 77760000 "sgfeedbackhelperz.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 77580000 "sgfeedbackhelperz.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 77580000 "sgfeedbackhelperz.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 77580000 "sgfeedbackhelperz.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 77580000 "jzr.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77580000 "jzr.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77580000 "jzr.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77580000 "jzr.exe" loaded module "KERNEL32" at base 77760000 "jzr.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 731f0000 "jzr.exe" loaded module "KERNEL32.DLL" at base 7776000056:T465,"360se.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "360se.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "360se.exe" was detected as "Microsoft Linker" and name: "Linker" "sgfeedbackhelperz.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "sgfeedbackhelperz.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "sgfeedbackhelperz.exe" was detected as "Microsoft Linker" and name: "Linker" "7z.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "7z.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "7z.dll" was detected as "Microsoft Linker" and name: "Linker" "7z.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "7z.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "7z.exe" was detected as "Microsoft Linker" and name: "Linker" "jzr.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "jzr.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "jzr.exe" was detected as "Microsoft Linker" and name: "Linker"57:T168b,"360se.exe" touched "MMDeviceEnumerator class" (Path: "HKCU\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}") "360se.exe" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "360se.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "360se.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "360se.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "360se.exe" touched "DLNA Media Servers Data Source" (Path: "HKCU\WOW6432NODE\CLSID\{289AF617-1CC3-42A6-926C-E6A863F0E3BA}\SHELLFOLDER") "360se.exe" touched "Portable Devices" (Path: "HKCU\WOW6432NODE\CLSID\{35786D3C-B075-49B9-88DD-029876E11C01}\SHELLFOLDER") "360se.exe" touched "Portable Media Devices" (Path: "HKCU\WOW6432NODE\CLSID\{640167B4-59B0-47A6-B335-A6B3C0695AEA}\SHELLFOLDER") "360se.exe" touched "delegate folder that appears in Computer" (Path: "HKCU\WOW6432NODE\CLSID\{B155BDF8-02F0-451E-9A26-AE317CFD7779}\SHELLFOLDER") "360se.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "360se.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "360se.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "360se.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "360se.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "360se.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "360se.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "360se.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "360se.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "360se.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "360se.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "360se.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "360se.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "360se.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "360se.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "360se.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "360se.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "360se.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "360se.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "360se.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "360se.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "360se.exe" touched "StreamBackedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "360se.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "360se.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "sgfeedbackhelper.exe" touched "Shell Drag and Drop helper" (Path: "HKCU\WOW6432NODE\CLSID\{4657278A-411B-11D2-839A-00C04FD918D0}") "sgfeedbackhelper.exe" touched "Microsoft Web Browser" (Path: "HKCU\WOW6432NODE\CLSID\{8856F961-340A-11D0-A96B-00C04FD705A2}\TREATAS") "sgfeedbackhelper.exe" touched "System Device Enumerator" (Path: "HKCU\WOW6432NODE\CLSID\{62BE5D10-60EB-11D0-BD3B-00A0C911CE86}\TREATAS") "sgfeedbackhelper.exe" touched "VFW Capture Class Manager" (Path: "HKCU\WOW6432NODE\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\TREATAS") "sgfeedbackhelper.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "sgfeedbackhelper.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "sgfeedbackhelper.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "sgfeedbackhelper.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "sgfeedbackhelper.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "sgfeedbackhelper.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS")58:Tb24,"360se.exe" file has an entrypoint instructions - "call 0x4355c4,jmp 0x434f9c,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17,call dword ptr [0x4531b0],test eax, eax,je 0x43513d,mov ecx, dword ptr [ebp + 8],int 0x29,push 3,call 0x435318,mov dword ptr [esp], 0x2cc,lea eax, [ebp - 0x324],push 0,push eax,call 0x436300,add esp, 0xc,mov dword ptr [ebp - 0x274], eax,mov dword ptr [ebp - 0x278], ecx,mov dword ptr [ebp - 0x27c], edx,mov dword ptr [ebp - 0x280], ebx,mov dword ptr [ebp - 0x284], esi," "sgfeedbackhelperz.exe" file has an entrypoint instructions - "call 0x536aa2,jmp 0x535d79,push ebp,mov ebp, esp,push 0,call dword ptr [0x57b2b0],push dword ptr [ebp + 8],call dword ptr [0x57b3b8],push 0xc0000409,call dword ptr [0x57b1f4],push eax,call dword ptr [0x57b27c],pop ebp,ret ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,sub esp, 0x324,push 0x17,call dword ptr [0x57b3bc],test eax, eax,je 0x535f44,push 2,pop ecx,int 0x29,mov dword ptr [0x5e3030], eax,mov dword ptr [0x5e302c], ecx,mov dword ptr [0x5e3028], edx," "7z.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,push ebx,mov ebx, dword ptr [ebp + 8],push esi,mov esi, dword ptr [ebp + 0xc],push edi,mov edi, dword ptr [ebp + 0x10],test esi, esi,jne 0x100e8aab,cmp dword ptr [0x1012ca88], 0,jmp 0x100e8ad1,cmp esi, 1,je 0x100e8ab5,cmp esi, 2,jne 0x100e8ad7,mov eax, dword ptr [0x1012caa0],test eax, eax,je 0x100e8ac7,push edi,push esi,push ebx,call eax,test eax, eax,je 0x100e8ad3,push edi,push esi,push ebx,call 0x100e89e4,test eax, eax,jne 0x100e8ad7,xor eax, eax,jmp 0x100e8b25,push edi,push esi,push ebx,call 0x100598a2,cmp esi, 1,mov dword ptr [ebp + 0xc], eax,jne 0x100e8af3,test eax, eax,jne 0x100e8b22,push edi,push eax,push ebx,call 0x100e89e4," "7z.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,push -1,push 0x44bd00,push 0x440804,mov eax, dword ptr fs:[0],push eax,mov dword ptr fs:[0], esp,sub esp, 0x20,push ebx,push esi,push edi,mov dword ptr [ebp - 0x18], esp,and dword ptr [ebp - 4], 0,push 1,call dword ptr [0x446170],pop ecx,or dword ptr [0x457814], 0xffffffff,or dword ptr [0x457818], 0xffffffff,call dword ptr [0x446174],mov ecx, dword ptr [0x45780c],mov dword ptr [eax], ecx,call dword ptr [0x446178],mov ecx, dword ptr [0x457808],mov dword ptr [eax], ecx,mov eax, dword ptr [0x44617c],mov eax, dword ptr [eax]," "jzr.exe" file has an entrypoint instructions - "call 0x404c50,jmp 0x402ed0,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x10,lea eax, [ebp - 4],mov dword ptr [ebp - 0xc], 0,push 0x4011ec,push 0x4011e8,mov dword ptr [ebp - 4], 0,mov dword ptr [ebp - 8], eax,mov dword ptr [ebp - 0x10], 0,call dword ptr [0x40804c],add esp, 8,test eax, eax,jne 0x402f37,push eax,push eax,push eax,lea eax, [ebp - 8],push eax,lea eax, [ebp - 0xc],push eax,call dword ptr [0x408044],push 0x4011e4,"59:T4c5,"360se.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "360se.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "360se.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "sgfeedbackhelper.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "sgfeedbackhelper.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "sgfeedbackhelper.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "sgfeedbackhelper.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "sgfeedbackhelperz.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "sgfeedbackhelperz.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "sgfeedbackhelperz.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "jzr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "jzr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "jzr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")5a:T59a,The input sample is signed with a certificate issued by "CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 82:79:B8:7C:89:50:7B:C6:E2:09:A7:BD:8B:5C:24:B3:1F:B9:A6:DC; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft Code Verification Root, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US" (SHA1: BA:3E:A5:4D:72:C1:45:D3:7C:25:5E:1E:A4:0A:FB:C6:33:48:B9:6E; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: A9:9D:5B:79:E9:F1:CD:A5:9C:DA:B6:37:31:69:D5:35:3F:58:74:C6; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 40:9A:A4:A7:4A:0C:DA:7C:0F:EE:6B:D0:BB:88:23:D1:6B:5F:18:75; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B6:C8:AF:83:4D:4E:53:B6:73:C7:68:72:AA:8C:95:0C:7C:54:DF:5F; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA, O="DigiCert Inc.", C=US" (SHA1: F3:87:22:4D:86:33:82:92:35:A9:94:BC:BD:8F:96:E9:FE:1C:7C:73; see report for more information)5b:T579,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "360se.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "360se.exe") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority" (Indicator: "LoadLibrary"; File: "360se.exe") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority : Priority Increased" (Indicator: "LoadLibrary"; File: "360se.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001248.00000001.310177.010D8000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003376.00000001.308317.732F9000.00000002.mdmp")5c:Tae8,"bzzbynMgNedca.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\SogouInput\E84C2983\bzzbynMgNedca.exe]- [targetUID: 00000000-00003552] "ImageMagik.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\SogouInput\E84C2983\ImageMagik.dll]- [targetUID: 00000000-00007764] "HWSignature.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\SogouInput\E84C2983\HWSignature.dll]- [targetUID: 00000000-00007764] "sgfeedbackhelperz.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\SogouInput\E84C2983\sgfeedbackhelperz.exe]- [targetUID: 00000000-00007764] "7z.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\SogouInput\E84C2983\7z.dll]- [targetUID: 00000000-00003552] "7z.exe" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 6 sections"- Location: [%PROGRAMFILES%\SogouInput\E84C2983\7z.exe]- [targetUID: 00000000-00003552] "jzr.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\SogouInput\E84C2983\jzr.exe]- [targetUID: 00000000-00001248] "bzzbynMg.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Unicoded MachineID ly0ysesstyjke3t Archive ctime=Sat Nov 22 03:53:26 2025 atime=Sat Nov 22 03:53:26 2025 mtime=Sat Nov 22 03:53:26 2025 length=3292544 window=normal IDListSize 0x01e9 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\Program Files\SogouInput\E84C2983\sgfeedbackhelper.exe""- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\bzzbynMg.lnk]- [targetUID: 00000000-00003552] "1.zip" has type "Zip archive data at least v2.0 to extract compression method=deflate"- Location: [%PROGRAMFILES%\SogouInput\E84C2983\1.zip]- [targetUID: 00000000-00003552] "asvv.txt" has type "data"- Location: [%PROGRAMFILES%\SogouInput\E84C2983\asvv.txt]- [targetUID: 00000000-00007764] "shouhu.txt" has type "data"- Location: [%PROGRAMFILES%\SogouInput\E84C2983\shouhu.txt]- [targetUID: 00000000-00003552] "bzzbynMgNedca.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "FaCveHBxNGHTyXP.lnkbOCafFc" has type "ASCII text with no line terminators"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FaCveHBxNGHTyXP.lnkbOCafFc]- [targetUID: 00000000-00001248] "sgfeedbackhelper.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\SogouInput\E84C2983\sgfeedbackhelper.exe]- [targetUID: 00000000-00007764]5d:T1084,"360se.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "360se.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "360se.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "360se.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}\"; Key: ""; Value: "") "360se.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}\"; Key: ""; Value: "") "360se.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{7FCCC86C-228A-40AD-8A58-F590AF7BFDCE}\##?#SCSI#DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR#5&3F6B946&0&000000#{7FCCC86C-228A-40AD-8A58-F590AF7BFDCE}\#"; Key: ""; Value: "") "360se.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{5B45201D-F2F2-4F3B-85BB-30FF1F953599}\##?#PCI#VEN_80EE&DEV_BEEF&SUBSYS_00000000&REV_00#3&267A616A&1&10#{5B45201D-F2F2-4F3B-85BB-30FF1F953599}\#"; Key: ""; Value: "") "360se.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{CAC88484-7515-4C03-82E6-71A87ABAC361}\##?#PCI#VEN_8086&DEV_100E&SUBSYS_001E8086&REV_02#3&267A616A&1&18#{CAC88484-7515-4C03-82E6-71A87ABAC361}\#"; Key: ""; Value: "") "360se.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53172480-4791-11D0-A5D6-28DB04C10000}\##?#ROOT#SYSTEM#0000#{53172480-4791-11D0-A5D6-28DB04C10000}\#{97EBAACC-95BD-11D0-A3EA-00A0C9223196}&{53172480-4791-11D0-A5D6-28DB04C10000}"; Key: ""; Value: "") "360se.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6EAD3D82-25EC-46BC-B7FD-C1F0DF8F5037}\##?#STORAGE#VOLUME#{C90825EC-2090-11E8-9BC1-806E6F6E6963}#000000001F500000#{6EAD3D82-25EC-46BC-B7FD-C1F0DF8F5037}\#"; Key: ""; Value: "") "360se.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\##?#STORAGE#VOLUME#{2DAE80CF-0637-11EE-9C2C-806E6F6E6963}#0000000000100000#{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\#"; Key: ""; Value: "") "360se.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{2ACCFE60-C130-11D2-B082-00A0C91EFB8B}\##?#PCI#VEN_15AD&DEV_07C0&SUBSYS_07C015AD&REV_02#FFA0BBC05005056A00#{2ACCFE60-C130-11D2-B082-00A0C91EFB8B}\#"; Key: ""; Value: "") "360se.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{378DE44C-56EF-11D1-BC8C-00A0C91405DD}\##?#ACPI#VMW0003#4&25EE97C0&0#{378DE44C-56EF-11D1-BC8C-00A0C91405DD}\#"; Key: ""; Value: "") "360se.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{7FCCC86C-228A-40AD-8A58-F590AF7BFDCE}\##?#SCSI#DISK&VEN_VMWARE&PROD_VIRTUAL_DISK#000000#{7FCCC86C-228A-40AD-8A58-F590AF7BFDCE}\#"; Key: ""; Value: "") "360se.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\##?#STORAGE#VOLUME#{D27478BC-2058-11E8-B41F-806E6F6E6963}#0000000000100000#{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\#"; Key: ""; Value: "") "360se.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&22A99211&0&0001#{6994AD04-93EF-11D0-A3CC-00A0C9223196}\#ESPDIFOUTTOPO"; Key: ""; Value: "") "360se.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{7FCCC86C-228A-40AD-8A58-F590AF7BFDCE}\##?#SCSI#DISK&VEN_VBOX&PROD_HARDDISK#4&3554261F&0&010000#{7FCCC86C-228A-40AD-8A58-F590AF7BFDCE}\#"; Key: ""; Value: "") "360se.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&22A99211&0&0001#{6994AD04-93EF-11D0-A3CC-00A0C9223196}\#EMICINTOPO"; Key: ""; Value: "")5e:Tbd4,"360se.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "DATA"; Value: "") "360se.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "GENERATION"; Value: "") "360se.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "DATA"; Value: "") "360se.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "") "360se.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\HTREE\ROOT\0"; Key: "CONTAINERID"; Value: "") "360se.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\DISPLAY\DEFAULT_MONITOR\1&8713BCA&0&UID0\PROPERTIES\{83DA6326-97A6-4088-9453-A1923F573B29}\000A"; Key: ""; Value: "") "360se.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\DISPLAY\DEFAULT_MONITOR\4&8B487E3&0&UID0\PROPERTIES\{83DA6326-97A6-4088-9453-A1923F573B29}\000A"; Key: ""; Value: "") "360se.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\PCI\VEN_80EE&DEV_BEEF&SUBSYS_040515AD&REV_00\3&267A616A&1&10\PROPERTIES\{83DA6326-97A6-4088-9453-A1923F573B29}\000A"; Key: ""; Value: "") "360se.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\DISPLAY\DEFAULT_MONITOR\4&39FC21A1&0&UID0\PROPERTIES\{83DA6326-97A6-4088-9453-A1923F573B29}\000A"; Key: ""; Value: "") "360se.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\PCI\VEN_80EE&DEV_BEEF&SUBSYS_00000000&REV_00\3&267A616A&1&10\PROPERTIES\{83DA6326-97A6-4088-9453-A1923F573B29}\000A"; Key: ""; Value: "") "360se.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\MMDEVAPI\{0.0.0.00000000}.{AFE9D18C-BC79-401B-8755-E68EE7C32C02}\PROPERTIES\{83DA6326-97A6-4088-9453-A1923F573B29}\000A"; Key: ""; Value: "") "360se.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\HDAUDIO\FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034\4&22A99211&0&0001\PROPERTIES\{83DA6326-97A6-4088-9453-A1923F573B29}\000A"; Key: ""; Value: "") "360se.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}"; Key: ""; Value: "") "360se.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "360se.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\INPROCSERVER32"; Key: ""; Value: "") "360se.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "")5f:T453,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Contains ability to detect sandbox (imports API) Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Makes a code branch decision directly after an API that is environment aware Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Possibly tries to evade analysis by sleeping many times Matched sigs: Able to perform sandbox evasion using APIs Matched sigs: Contains ability to delay the execution of current thread60:T624,"360se.exe" touched file "C:\Program Files\SOGOUINPUT\E84C2983\ABC\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP" "360se.exe" touched file "C:\Program Files\SOGOUINPUT\E84C2983\ABC\MICROSOFT\WINDOWS\START MENU\PROGRAMS" "360se.exe" touched file "C:\Program Files\SOGOUINPUT\E84C2983\ABC\MICROSOFT\WINDOWS\START MENU" "360se.exe" touched file "C:\Program Files\SOGOUINPUT\E84C2983\ABC\MICROSOFT\WINDOWS" "360se.exe" touched file "C:\Program Files\SOGOUINPUT\E84C2983\ABC\MICROSOFT" "360se.exe" touched file "C:\Program Files\SOGOUINPUT\E84C2983\ABC" "360se.exe" touched file "C:\Program Files\SOGOUINPUT\E84C2983" "360se.exe" touched file "C:\Program Files\SogouInput\E84C2983\asvv.txt" "360se.exe" touched file "C:\Program Files\SogouInput\E84C2983\shouhu.txt" "360se.exe" touched file "C:\Program Files\SogouInput\E84C2983\1.zip" "360se.exe" touched file "C:\Program Files\SogouInput\E84C2983\bzzbynMgNedca.exe" "360se.exe" touched file "C:\Program Files\SogouInput\E84C2983\bzzbynMgNedca.exe:Zone.Identifier" "360se.exe" touched file "C:\Program Files\SogouInput\E84C2983\jzr.exe" "360se.exe" touched file "C:\Program Files\SogouInput\E84C2983\7z.exe" "360se.exe" touched file "C:\Program Files\SogouInput\E84C2983\HWSignature.dll" "360se.exe" touched file "C:\Program Files\SogouInput\E84C2983\ImageMagik.dll" "360se.exe" touched file "C:\Program Files\SogouInput\E84C2983\sgfeedbackhelper.exe" "360se.exe" touched file "C:\Program Files\SogouInput\E84C2983\sgfeedbackhelperz.exe" "360se.exe" touched file "C:\Program Files\SogouInput\E84C2983\7z.dll"61:T58c,"360se.exe" touched file "C:\Program Files\SOGOUINPUT\E84C2983\ABC\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP" "360se.exe" touched file "C:\Program Files\SOGOUINPUT\E84C2983\ABC\MICROSOFT\WINDOWS\START MENU\PROGRAMS" "360se.exe" touched file "C:\Program Files\SOGOUINPUT\E84C2983\ABC\MICROSOFT\WINDOWS\START MENU" "360se.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "360se.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bzzbynMg.lnk" "360se.exe" touched file "%PROGRAMFILES%\SOGOUINPUT\E84C2983\ABC\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP" "360se.exe" touched file "%PROGRAMFILES%\SOGOUINPUT\E84C2983\ABC\MICROSOFT\WINDOWS\START MENU\PROGRAMS" "360se.exe" touched file "%PROGRAMFILES%\SOGOUINPUT\E84C2983\ABC\MICROSOFT\WINDOWS\START MENU" "360se.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "360se.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\bzzbynMg.lnk" "sgfeedbackhelper.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "sgfeedbackhelper.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "jzr.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FaCveHBxNGHTyXP.lnkbOCafFc" "jzr.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FaCveHBxNGHTyXP.lnkbOCafFc"62:T67e,"360se.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "360se.exe" trying to access non-existent file "C:\BCRYPT.DLL" "360se.exe" trying to access non-existent file "C:\FLTLIB.DLL" "360se.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "360se.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "360se.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "360se.exe" trying to access non-existent file "C:\KERNEL32.DLL" "360se.exe" trying to access non-existent file "C:\Kernel32.dll" "360se.exe" trying to access non-existent file "C:\ADVPACK.DLL" "360se.exe" trying to access non-existent file "C:\advpack.dll" "360se.exe" trying to access non-existent file "C:\VERSION.DLL" "360se.exe" trying to access non-existent file "C:\VERSION.dll" "360se.exe" trying to access non-existent file "C:\360SE.EXE" "360se.exe" trying to access non-existent file "C:\360se.exe" "360se.exe" trying to access non-existent file "C:\PROPSYS.DLL" "360se.exe" trying to access non-existent file "C:\PROPSYS.dll" "360se.exe" trying to access non-existent file "C:\CLDAPI.DLL" "360se.exe" trying to access non-existent file "C:\CLDAPI.dll" "360se.exe" trying to access non-existent file "C:\AEPIC.DLL" "360se.exe" trying to access non-existent file "C:\AEPIC.dll" "360se.exe" trying to access non-existent file "C:\LINKINFO.DLL" "360se.exe" trying to access non-existent file "C:\LINKINFO.dll" "360se.exe" trying to access non-existent file "C:\NTSHRUI.DLL" "360se.exe" trying to access non-existent file "C:\ntshrui.dll" "360se.exe" trying to access non-existent file "C:\SRVCLI.DLL"63:T584,"360se.exe" trying to access non-existent file "C:\360SE.EXE.LOCAL" "360se.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BZZBYNMG.LNK" "360se.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bzzbynMg.lnk" "360se.exe" trying to access non-existent file "C:\PROGRAM" "360se.exe" trying to access non-existent file "C:\Program" "sgfeedbackhelper.exe" trying to access non-existent file "C:\Program Files\SogouInput\E84C2983\SGFEEDBACKHELPER.EXE.LOCAL" "sgfeedbackhelper.exe" trying to access non-existent file "C:\Program Files\SogouInput\E84C2983\DATA" "sgfeedbackhelper.exe" trying to access non-existent file "C:\Program Files\SogouInput\E84C2983\Data" "sgfeedbackhelper.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\LOG" "sgfeedbackhelper.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\LOG\APP" "sgfeedbackhelper.exe" trying to access non-existent file "C:\Program Files\SogouInput\E84C2983\sgfeedbackhelper.exe.Local\" "sgfeedbackhelper.exe" trying to access non-existent file "C:\Program Files\SogouInput\E84C2983\sgfeedbackhelperz.exe:ZONE.IDENTIFIER" "sgfeedbackhelper.exe" trying to access non-existent file "C:\Program Files\SogouInput\E84C2983\sgfeedbackhelperz.exe:Zone.Identifier"64:T1118,Heuristic match: "rvqh.hr" Heuristic match: "t$$h.hr" Heuristic match: "e.so.com" Heuristic match: ".mediav.com" Heuristic match: "tf.360.cn" Heuristic match: "so.mp.360.cn" Heuristic match: "../../chrome/app/chrome_exe_main_win.cc" Pattern match: "http://seupdate.360safe.com/se6/360se6.cab?ver=" Heuristic match: "../../third_party/abseil-cpp/absl/types/bad_variant_access.cc" Heuristic match: "../../base/run_loop.cc" Heuristic match: "../../base/file_version_info_win.cc" Heuristic match: "../../base/files/file_util_win.cc" Heuristic match: "../../base/process/launch_win.cc" Heuristic match: "../../base/threading/platform_thread_win.cc" Heuristic match: "../../base/win/win_util.cc" Heuristic match: "../../base/360/qihoo_util.cc" Heuristic match: "blink.net" Heuristic match: "../../base/trace_event/trace_log.cc" Heuristic match: "aaaabbbbccccddddeeeeffffgggghhhhiiiijjjjkkkkllllmmmmnnnnooooppppqqqqrrrrssssttttuuuuvvvvwwwwxxxxyyyyzzzzaaaabbbbccccddddeeeeffffgggghhhhiiiijjjjkkkkllllmmmmnnnnooooppppqqqqrrrrssssttttuuuuvvvvwwwwxxxxyyyyzzzz0000111122223333444455556666777788889999++++////" Heuristic match: "../../base/debug/activity_tracker.cc" Heuristic match: "../../base/metrics/statistics_recorder.cc" Heuristic match: "../../base/threading/scoped_blocking_call_internal.cc" Heuristic match: "../../base/native_library_win.cc" Heuristic match: "../../base/threading/thread.cc" Pattern match: "extensions.database.open/0x" Heuristic match: "../../sandbox/win/src/sandbox_policy_base.cc" Pattern match: "http://se.360.cn/" Pattern match: "http://download.microsoft.com/download/f/f/f/fffecf33-d8a0-4949-838b-703ff05e58ca/ime2010_zh-cn.exe" Pattern match: "http://bbs.360safe.com/thread-4452447-1-1.html" Pattern match: "http://cloud.browser.360.cn/hp/sea" Pattern match: "http://127.0.0.1/%s" Pattern match: "http://dd.browser.360.cn/static/a/1243.3157.gif" Pattern match: "http://bbs.360.cn/thread-15667307-1-1.html" Pattern match: "http://dd.browser.360.cn/static/a/1243.869.gif?_referer=1" Pattern match: "http://dd.browser.360.cn/static/a/1243.869.gif?_referer=0" Heuristic match: "360.cn" Pattern match: "uvf.uof/u_3g@@fa@@;j\zf;?urfuu0fnu" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0washington1redmond1microsoft" Pattern match: "qy.nux/@8xvl4]1[o^p[ms*`0" Heuristic match: "e:\landun\pinyin_agent\workspace\p-f93f0d74ed8a49278e11882bf2562c5a\src\src\cannon\src\chromium_base\base\metrics\persistent_memory_allocator.cc" Heuristic match: "e:\landun\pinyin_agent\workspace\p-f93f0d74ed8a49278e11882bf2562c5a\src\src\cannon\src\chromium_base\base\metrics\statistics_recorder.cc" Pattern match: "https://pinyin.sogou.com/helpcenter/client" Pattern match: "http://www.eyuyan.com" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "sc.im" Heuristic match: "/muv.mo" Heuristic match: "t..mn" Heuristic match: "software\sogouinput.tc" Pattern match: "www.digicert.com1$0" Pattern match: "www.digicert.com110/" Pattern match: "http://ocsp.digicert.com0c" Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0" Pattern match: "crl4.digicert.com/digicertassuredidrootca.crl0" Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0o" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://crl3.digicert.com/sha2-assured-cs-g1.crl05" Pattern match: "http://crl4.digicert.com/sha2-assured-cs-g1.crl0k" Pattern match: "http://www.digicert.com/cps0" Pattern match: "http://ocsp.digicert.com0n" Pattern match: "cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt0" Pattern match: "crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0" Pattern match: "http://ocsp.digicert.com0x" Pattern match: "cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0" Pattern match: "www.digicert.com1!0" Pattern match: "http://ocsp.digicert.com0a" Pattern match: "cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "crl3.digicert.com/digicerttrustedrootg4.crl0" Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0e" Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0" Heuristic match: "40.gf" Heuristic match: "ww.m.as" Heuristic match: "u%.la" Heuristic match: "so.pk"65:T496b,Found URL "http://www.eyuyan.com)varfileinfotranslation" - Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found URL "http://www.eyuyan.com)varfileinfotranslation!this" - Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003376.00000000.308171.03810000.00000004.mdmp") Found URL "http://www.eyuyan.com)varfileinfotranslation" - Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp") Found URL "http://www.eyuyan.com)varfileinfotranslationath=c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;%nvm_home%;%nvm_symlink%;c:\users\hapubws\appdata\local\programs\python\python311\scripts\;c:\users\hapubws\appdata\local\programs\python\python311\;c:\users\hapubws\appdata\local\microsoft\windowsapps;c:\program" - Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp") Found URL "https://pinyin.sogou.com/helpcenter/cliente4ed2a98_70f1_4a86_902e_d1877e2ce298_sgfeedbackmainfeedbackhelper_captiontabsgfeedbackmain.xmlneterror_retryservererror_retryfeedbackhelper_openwithbrowserfeedbackhelper_downloadcefretryfeedbackhelper_pagetabfeedbackhelper_webbroweriefeedbackhelper_webbrowerceffeedbackhelper_progresstextfeedbackhelper_progressarrowfeedbackhelper_progresssgfeedbackweb.xmle3805d0a_95d8_45a5_b888_94a485dc1b5_sgfeedbackwebsgdownloadcef_b0fc18ef-f93f-409c-a99d-6e2174843427%d%%/helpcenter/helpcenter/client%s%s&%s%s&%s%sdebug.loguser32.dllkernel32.dllntdll.dllkernel32.dllsoftware\microsoft\windows" - Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0oh0f080*0(https://www.digicert.com/cps0," - Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found URL "http://crl3.digicert.com/sha2-assured-cs-g1.crl05/http://crl4.digicert.com/sha2-assured-cs-g1.crl0kd0b060)0'http://www.digicert.com/cps0x0v0$http://ocsp.digicert.com0nbhttp://cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt0e7aa*" - Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0*9z9ndo>fd;ig2xjk7*lp0uxhjyct[cfgc8g(f*^[0digicert" - Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0" - Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003376.00000001.308317.03810000.00000004.mdmp") Found URL "http://www.eyuyan.com)varfileinfotranslation" - Source: "00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found URL "http://www.eyuyan.com)varfileinfotranslationath=c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;%nvm_home%;%nvm_symlink%;c:\users\hapubws\appdata\local\programs\python\python311\scripts\;c:\users\hapubws\appdata\local\programs\python\python311\;c:\users\hapubws\appdata\local\microsoft\windowsapps;c:\program" - Source: "00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003552.00000000.307136.039D0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003552.00000001.307698.039D0000.00000004.mdmp") Found URL "http://www.eyuyan.com)varfileinfotranslation" - Source: "00000000-00007704.00000000.308255.00400000.00000040.mdmp") Found URL "http://www.eyuyan.com)varfileinfotranslation!this" - Source: "00000000-00007704.00000000.308255.00400000.00000040.mdmp") Found URL "https://pinyin.sogou.com/helpcenter/cliente4ed2a98_70f1_4a86_902e_d1877e2ce298_sgfeedbackmainfeedbackhelper_captiontabsgfeedbackmain.xmlneterror_retryservererror_retryfeedbackhelper_openwithbrowserfeedbackhelper_downloadcefretryfeedbackhelper_pagetabfeedbackhelper_webbroweriefeedbackhelper_webbrowerceffeedbackhelper_progresstextfeedbackhelper_progressarrowfeedbackhelper_progresssgfeedbackweb.xmle3805d0a_95d8_45a5_b888_94a485dc1b5_sgfeedbackwebsgdownloadcef_b0fc18ef-f93f-409c-a99d-6e2174843427%d%%/helpcenter/helpcenter/client%s%s&%s%s&%s%sdebug.loguser32.dllkernel32.dllntdll.dllkernel32.dllsoftware\microsoft\windows" - Source: "00000000-00007764.00000000.307984.0112B000.00000002.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0oh0f080*0(https://www.digicert.com/cps0," - Source: "00000000-00007764.00000000.307984.0112B000.00000002.mdmp") Found URL "http://crl3.digicert.com/sha2-assured-cs-g1.crl05/http://crl4.digicert.com/sha2-assured-cs-g1.crl0kd0b060)0'http://www.digicert.com/cps0x0v0$http://ocsp.digicert.com0nbhttp://cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt0e7aa*" - Source: "00000000-00007764.00000000.307984.0112B000.00000002.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0*9z9ndo>fd;ig2xjk7*lp0uxhjyct[cfgc8g(f*^[0digicert" - Source: "00000000-00007764.00000000.307984.0112B000.00000002.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00007764.00000000.307984.0112B000.00000002.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0" - Source: "00000000-00007764.00000000.307984.0112B000.00000002.mdmp") Found URL "http://www.virtualbox.orgoracle" - Source: "00000000-00007764.00000000.307984.03710000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00007764.00000000.307984.03710000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00007764.00000000.307984.03710000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00007764.00000000.307984.03710000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00007764.00000000.307984.03710000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00007764.00000000.307984.03710000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00007764.00000000.307984.03710000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00007764.00000000.307984.03710000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00007764.00000000.307984.03710000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00007764.00000000.307984.03710000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00007764.00000000.307984.03710000.00000004.mdmp") Found URL "https://www.msn.com/favicon.icoc:\windows\system32\usercpl.dll" - Source: "00000000-00007764.00000000.307984.03710000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00007764.00000000.307984.03710000.00000004.mdmp") Found URL "https://npcap.com/oracle" - Source: "00000000-00007764.00000001.309906.03710000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00007764.00000001.309906.03710000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00007764.00000001.309906.03710000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00007764.00000001.309906.03710000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00007764.00000001.309906.03710000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00007764.00000001.309906.03710000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00007764.00000001.309906.03710000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00007764.00000001.309906.03710000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00007764.00000001.309906.03710000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00007764.00000001.309906.03710000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00007764.00000001.309906.03710000.00000004.mdmp") Found URL "https://www.msn.com/favicon.icoc:\windows\system32\usercpl.dll" - Source: "00000000-00007764.00000001.309906.03710000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00007764.00000001.309906.03710000.00000004.mdmp") Found URL "https://npcap.com/oracle" - Source: "00000000-00007764.00000002.311825.03710000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00007764.00000002.311825.03710000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00007764.00000002.311825.03710000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00007764.00000002.311825.03710000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00007764.00000002.311825.03710000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00007764.00000002.311825.03710000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00007764.00000002.311825.03710000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00007764.00000002.311825.03710000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00007764.00000002.311825.03710000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00007764.00000002.311825.03710000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00007764.00000002.311825.03710000.00000004.mdmp") Found URL "https://www.msn.com/favicon.icoc:\windows\system32\usercpl.dll" - Source: "00000000-00007764.00000002.311825.03710000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00007764.00000002.311825.03710000.00000004.mdmp") Found URL "https://npcap.com/" (Indicator: "chacha"; File: "360se.exe") Found string "AES for Intel AES-NI, CRYPTOGAMS by " (Indicator: "aes"; File: "360se.exe") Found string "Vector Permutation AES for x86/SSSE3, Mike Hamburg (Stanford University)" (Indicator: "aes"; File: "360se.exe") Found string "3DES_112" (Indicator: "3des"; File: "360se.exe") Found string "ECDSA_P256" (Indicator: "ecdsa"; File: "360se.exe") Found string "ECDSA_P384" (Indicator: "ecdsa"; File: "360se.exe") Found string "ECDSA_P521" (Indicator: "ecdsa"; File: "360se.exe") file/memory contains long string with (Indicator: "aes"; File: "7z.exe") file/memory contains long string with (Indicator: "aes128"; File: "7z.exe") file/memory contains long string with (Indicator: "aes192"; File: "7z.exe") file/memory contains long string with (Indicator: "aes256"; File: "7z.exe") Found string "3DES_112" (Indicator: "3des"; Source: "00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found string "ECDSA_P256" (Indicator: "ecdsa"; Source: "00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found string "ECDSA_P384" (Indicator: "ecdsa"; Source: "00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found string "ECDSA_P521" (Indicator: "ecdsa"; Source: "00000000-00003376.00000001.308317.732F9000.00000002.mdmp")6a:T1047,Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "360se.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "360se.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "360se.exe") Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "360se.exe") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "360se.exe") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "360se.exe") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "360se.exe") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003376.00000000.308171.03810000.00000004.mdmp, 00000000-00003376.00000001.308317.03810000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003376.00000000.308171.03810000.00000004.mdmp, 00000000-00003376.00000001.308317.03810000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00003376.00000000.308171.03810000.00000004.mdmp, 00000000-00003376.00000001.308317.03810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003376.00000000.308171.03810000.00000004.mdmp, 00000000-00003376.00000001.308317.03810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003376.00000000.308171.03810000.00000004.mdmp, 00000000-00003376.00000001.308317.03810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003376.00000000.308171.03810000.00000004.mdmp, 00000000-00003376.00000001.308317.03810000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00003376.00000000.308171.03810000.00000004.mdmp, 00000000-00003376.00000001.308317.03810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003376.00000000.308171.03810000.00000004.mdmp, 00000000-00003376.00000001.308317.03810000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003552.00000000.307136.039D0000.00000004.mdmp, 00000000-00003552.00000001.307698.039D0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003552.00000000.307136.039D0000.00000004.mdmp, 00000000-00003552.00000001.307698.039D0000.00000004.mdmp")6b:T5b3,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "360se.exe") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "360se.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "360se.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp")6c:Tf0e,Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "360se.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "360se.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "360se.exe") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "360se.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "360se.exe") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "360se.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "360se.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "360se.exe") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "360se.exe") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "360se.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "360se.exe") Found reference to API "9896493416,1536,3125,,Process32NextW,kernel32.dll,"01:20:16.468",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00001248.00000000.308256.00F40000.00000004.mdmp") Found reference to API "9898389436,1536,3125,,Process32NextW,kernel32.dll,"01:20:16.468",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00001248.00000000.308256.00F40000.00000004.mdmp") Found reference to API "9892021978,1536,3125,,Process32NextW,kernel32.dll,"01:20:16.468",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00001248.00000000.308256.00F40000.00000004.mdmp") Found reference to API "9897439384,1536,3125,,Process32NextW,kernel32.dll,"01:20:16.468",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00001248.00000000.308256.00F40000.00000004.mdmp") Found reference to API "9881537150,1536,3125,,Process32NextW,kernel32.dll,"01:20:16.468",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00001248.00000000.308256.00F40000.00000004.mdmp") Found reference to API "9896040254,1536,3125,,Process32NextW,kernel32.dll,"01:20:16.468",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00001248.00000000.308256.00F40000.00000004.mdmp") Found reference to API "9891062338,1536,3125,,Process32NextW,kernel32.dll,"01:20:16.468",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00001248.00000000.308256.00F40000.00000004.mdmp") Found reference to API "9896982376,1536,3125,,Process32NextW,kernel32.dll,"01:20:16.468",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00001248.00000000.308256.00F40000.00000004.mdmp") Found reference to API "9895073122,1536,3125,,Process32NextW,kernel32.dll,"01:20:16.468",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00001248.00000000.308256.00F40000.00000004.mdmp") Found reference to API "9884364670,1536,3125,,Process32NextW,kernel32.dll,"01:20:16.468",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00001248.00000000.308256.00F40000.00000004.mdmp") Found reference to API "9886749360,1536,3125,,Process32NextW,kernel32.dll,"01:20:16.468",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00001248.00000000.308256.00F40000.00000004.mdmp") Found reference to API "9832912480,1536,3125,,Process32NextW,kernel32.dll,"01:20:16.453",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00001248.00000000.308256.00F40000.00000004.mdmp") Found reference to API "9883429316,1536,3125,,Process32NextW,kernel32.dll,"01:20:16.468",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00001248.00000000.308256.00F40000.00000004.mdmp") Found reference to API "9895552752,1536,3125,,Process32NextW,kernel32.dll,"01:20:16.468",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00001248.00000000.308256.00F40000.00000004.mdmp")6d:T439,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "360se.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "360se.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "360se.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp")6e:Te41,Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "360se.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "360se.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "360se.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "360se.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "360se.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "360se.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "360se.exe") Found reference to API "NtQueryAttributesFile" (Indicator: "QueryAttributesFile"; File: "360se.exe") Found reference to API "NtQueryFullAttributesFile" (Indicator: "QueryFullAttributesFile"; File: "360se.exe") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "360se.exe") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "360se.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "360se.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "360se.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp")6f:T9cc,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "360se.exe") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "360se.exe") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; File: "360se.exe") Found reference to API "NtOpenProcessToken" (Indicator: "NtOpenProcessToken"; File: "360se.exe") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; File: "360se.exe") Found reference to API "NtOpenProcessTokenEx" (Indicator: "NtOpenProcessToken"; File: "360se.exe") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcessToken"; File: "360se.exe") Found reference to API "NtOpenThreadToken" (Indicator: "NtOpenThreadToken"; File: "360se.exe") Found reference to API "NtOpenThreadTokenEx" (Indicator: "NtOpenThreadToken"; File: "360se.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "360se.exe") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; File: "360se.exe") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "360se.exe") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001248.00000001.310177.010D8000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001248.00000001.310177.010D8000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001248.00000001.310177.010D8000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp")70:T444,Found string "OpenProcessToken" (Indicator: "OpenProcess"; File: "360se.exe") Found string "OpenProcess" (Indicator: "OpenProcess"; File: "360se.exe") Found string "NtOpenProcess" (Indicator: "OpenProcess"; File: "360se.exe") Found string "NtOpenProcessToken" (Indicator: "OpenProcess"; File: "360se.exe") Found string "NtOpenProcessTokenEx" (Indicator: "OpenProcess"; File: "360se.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "jzr.exe") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00001248.00000001.310177.010D8000.00000002.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp")71:T576,Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "360se.exe") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "360se.exe") Found reference to API "DeleteFile.NonRecursive" (Indicator: "DeleteFile"; File: "00000000-00007764.00000000.307984.00FB1000.00000020.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "DeleteFile.NonRecursive" (Indicator: "DeleteFile"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp")72:T400,Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp")73:Ta8e,Found reference to API "RtlDeriveCapabilitySidsFromName" (Indicator: "DeriveCapabilitySidsFromName"; File: "360se.exe") Found reference to API "AccessCheck" (Indicator: "AccessCheck"; File: "360se.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "360se.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "360se.exe") Found reference to API "CopySid" (Indicator: "CopySid"; File: "360se.exe") Found reference to API "CreateRestrictedToken" (Indicator: "CreateRestrictedToken"; File: "360se.exe") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; File: "360se.exe") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; File: "360se.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "360se.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "360se.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "360se.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "360se.exe") Found reference to API "GetAce" (Indicator: "GetAce"; File: "360se.exe") Found reference to API "GetKernelObjectSecurity" (Indicator: "GetKernelObjectSecurity"; File: "360se.exe") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "360se.exe") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; File: "360se.exe") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "360se.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "360se.exe") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; File: "360se.exe") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; File: "360se.exe") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; File: "360se.exe") Found reference to API "MapGenericMask" (Indicator: "MapGenericMask"; File: "360se.exe") Found reference to API "AddAccessAllowedAceEx" (Indicator: "AddAccessAllowedAce"; File: "360se.exe") Found reference to API "AddAccessAllowedAceEx" (Indicator: "AddAccessAllowedAceEx"; File: "360se.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "360se.exe") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "360se.exe") Found reference to API "SetSecurityDescriptorSacl" (Indicator: "SetSecurityDescriptorSacl"; File: "360se.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "360se.exe")74:T652,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "360se.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "360se.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "360se.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp, 00000000-00001248.00000001.310177.010D8000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001248.00000001.310177.00400000.00000040.mdmp, 00000000-00001248.00000001.310177.010D8000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp") Found reference to API "NtTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003376.00000001.308317.732F9000.00000002.mdmp")75:Tc58,Observed import api "AddAccessAllowedAce" which can "add an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: sgfeedbackhelperz.exe] Observed import api "AddAccessAllowedAceEx" which can "add an access-allowed access control entry (ACE) to the end of a discretionary access control list (DACL)" [Source: sgfeedbackhelperz.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: sgfeedbackhelperz.exe] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: sgfeedbackhelperz.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: sgfeedbackhelperz.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: sgfeedbackhelperz.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: sgfeedbackhelperz.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: sgfeedbackhelperz.exe] Observed import api "SetSecurityDescriptorSacl" which can "set information in a system access control list (SACL)" [Source: sgfeedbackhelperz.exe] Observed import api "GetFileSecurityW" which can "obtain specified information about the security of a file or directory" [Source: 7z.exe] Observed import api "SetFileSecurityW" which can "set the security of a file or directory object" [Source: 7z.exe] Observed import api "AddAccessAllowedAce" which can "add an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: jzr.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: jzr.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: jzr.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: jzr.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: jzr.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: jzr.exe] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: jzr.exe] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: jzr.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: jzr.exe] Observed import api "DeriveCapabilitySidsFromName" which can "construct two arrays of SIDs out of a capability name" [Source: jzr.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: jzr.exe]76:T994,"360se.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WCIFS"; Key: "SUPPORTEDFEATURES"; Value: "") "360se.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WOF"; Key: "SUPPORTEDFEATURES"; Value: "") "360se.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FILEINFO"; Key: "SUPPORTEDFEATURES"; Value: "") "360se.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "360se.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES\SOGOUINPUT\E84C2983\SGFEEDBACKHELPER.EXE"; Value: "") "sgfeedbackhelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "sgfeedbackhelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "sgfeedbackhelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "sgfeedbackhelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "sgfeedbackhelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "sgfeedbackhelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "sgfeedbackhelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "sgfeedbackhelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "sgfeedbackhelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "sgfeedbackhelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "sgfeedbackhelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "")77:T2bdc,"360se.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM"; Key: "ENABLELUA"; Value: "0000000000") "360se.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER"; Key: "DISABLEANTISPYWARE"; Value: "0100000000") "sgfeedbackhelper.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "sgfeedbackhelper.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "sgfeedbackhelper.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "sgfeedbackhelper.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "sgfeedbackhelper.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE"; Key: "IPDATES_INFO"; Value: "0000000000000000000000000000000000000000000000000000000000003100350034002E00390031002E00360034002E0036003500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000360036003600360000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000003100350034002E00390031002E00360034002E00360035000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003600360036003600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000003100350034002E00390031002E00360034002E0036003500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000360036003600360000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000D89EA48B00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000031002E0030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000032003000320036002E00200032002E0020003600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000") "sgfeedbackhelperz.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM"; Key: "ENABLELUA"; Value: "0000000000") "sgfeedbackhelperz.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER"; Key: "DISABLEANTISPYWARE"; Value: "0100000000") "jzr.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.LNKBOCAFFC"; Key: "(DEFAULT)"; Value: "FaCveHBxN"), "jzr.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\FACVEHBXN\SHELL\OPEN\COMMAND"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\SogouInput\E84C2983\sgfeedbackhelper.exe")78:T49b,Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; File: "360se.exe") Found reference to API "OpenMutexW" (Indicator: "OpenMutex"; File: "360se.exe") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; File: "360se.exe") Found reference to API "CreateMutex" (Indicator: "CreateMutex"; File: "00000000-00007764.00000000.307984.00FB1000.00000020.mdmp") Found reference to API "CreateMutex2" (Indicator: "CreateMutex"; File: "00000000-00007764.00000000.307984.00FB1000.00000020.mdmp") Found reference to API "CreateMutex2" (Indicator: "CreateMutex"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "CreateMutex" (Indicator: "CreateMutex"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "OpenMutexW" (Indicator: "OpenMutex"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00003376.00000001.308317.00F4B000.00000002.mdmp")79:T8a6,Found string "SleepConditionVariableCS" (Source: 360se.exe, API is part of module: KERNELBASE.DLL) Found string "FlsAlloc" (Source: 360se.exe, API is part of module: KERNELBASE.DLL) Found string "FlsFree" (Source: 360se.exe, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: 360se.exe, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: 360se.exe, API is part of module: KERNELBASE.DLL) Found string "log10" (Source: 360se.exe, API is part of module: MSVCRT.DLL) Found string "LocaleNameToLCID" (Source: 360se.exe, API is part of module: KERNELBASE.DLL) Found string "AppPolicyGetProcessTerminationMethod" (Source: 360se.exe, API is part of module: KERNEL.APPCORE.DLL) Found string "SystemFunction036" (Source: 360se.exe, API is part of module: CRYPTBASE.DLL) Found string "atan2" (Source: 360se.exe, API is part of module: MSVCRT.DLL) Found string "floor" (Source: 360se.exe, API is part of module: MSVCRT.DLL) Found string "ldexp" (Source: 360se.exe, API is part of module: MSVCRT.DLL) Found string "frexp" (Source: 360se.exe, API is part of module: MSVCRT.DLL) Found string "IsNTAdmin" (Source: 360se.exe, API is part of module: ADVPACK.DLL) Found string "GetDpiForMonitor" (Source: 360se.exe, API is part of module: SHCORE.DLL) Found string "RtlGetVersion" (Source: 360se.exe, API is part of module: NTDLL.DLL) Found string "GetModuleBaseNameW" (Source: 360se.exe, API is part of module: PSAPI.DLL) Found string "GetModuleInformation" (Source: 360se.exe, API is part of module: PSAPI.DLL) Found string "RtlCaptureStackBackTrace" (Source: 360se.exe, API is part of module: KERNEL32.DLL) Found string "SleepConditionVariableSRW" (Source: 360se.exe, API is part of module: KERNELBASE.DLL) Found string "SetThreadDescription" (Source: 360se.exe, API is part of module: KERNELBASE.DLL) Found string "GetThreadId" (Source: 360se.exe, API is part of module: KERNELBASE.DLL) Found string "NtQueryInformationThread" (Source: 360se.exe, API is part of module: NTDLL.DLL) Found string "RegDeleteKeyExW" (Source: 360se.exe, API is part of module: ADVAPI32.DLL) Found string "SetProcessDPIAware" (Source: 360se.exe, API is part of module: USER32.DLL)7a:T4fa,"360se.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{7FCCC86C-228A-40AD-8A58-F590AF7BFDCE}\##?#SCSI#DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR#5&3F6B946&0&000000#{7FCCC86C-228A-40AD-8A58-F590AF7BFDCE}\#") "360se.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{7FCCC86C-228A-40AD-8A58-F590AF7BFDCE}\##?#SCSI#DISK&VEN_VMWARE&PROD_VIRTUAL_DISK#000000#{7FCCC86C-228A-40AD-8A58-F590AF7BFDCE}\#") "360se.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\##?#SCSI#CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD01#5&3F6B946&0&010000#{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\#") "360se.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}\##?#SCSI#DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR#5&3F6B946&0&000000#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}\#") "360se.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F56308-B6BF-11D0-94F2-00A0C91EFB8B}\##?#SCSI#CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD01#5&3F6B946&0&010000#{53F56308-B6BF-11D0-94F2-00A0C91EFB8B}\#") "360se.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}\##?#SCSI#DISK&VEN_VMWARE&PROD_VIRTUAL_DISK#000000#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}\#")7b:T408,"360se.exe" reads file "C:\Program Files\desktop.ini" "360se.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "360se.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "360se.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "360se.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "360se.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "360se.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "360se.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "sgfeedbackhelper.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "sgfeedbackhelper.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "sgfeedbackhelper.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "sgfeedbackhelper.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "sgfeedbackhelper.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "sgfeedbackhelper.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "sgfeedbackhelper.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini"7c:T5d7,"bzzbynMgNedca.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\SogouInput\E84C2983\bzzbynMgNedca.exe]- [targetUID: 00000000-00003552] "ImageMagik.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\SogouInput\E84C2983\ImageMagik.dll]- [targetUID: 00000000-00007764] "HWSignature.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\SogouInput\E84C2983\HWSignature.dll]- [targetUID: 00000000-00007764] "sgfeedbackhelperz.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\SogouInput\E84C2983\sgfeedbackhelperz.exe]- [targetUID: 00000000-00007764] "7z.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\SogouInput\E84C2983\7z.dll]- [targetUID: 00000000-00003552] "7z.exe" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 6 sections"- Location: [%PROGRAMFILES%\SogouInput\E84C2983\7z.exe]- [targetUID: 00000000-00003552] "jzr.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\SogouInput\E84C2983\jzr.exe]- [targetUID: 00000000-00001248] "sgfeedbackhelper.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\SogouInput\E84C2983\sgfeedbackhelper.exe]- [targetUID: 00000000-00007764]7d:T47f,"360se.exe" wrote 44520 bytes starting with PE header signature to file "C:\Program Files\SogouInput\E84C2983\jzr.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "360se.exe" wrote 16384 bytes starting with PE header signature to file "C:\Program Files\SogouInput\E84C2983\7z.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "360se.exe" wrote 16384 bytes starting with PE header signature to file "C:\Program Files\SogouInput\E84C2983\HWSignature.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000280100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...7e:T42f,RegCloseKey RegCreateKeyW RegOpenKeyExW RegCreateKeyExW OpenProcessToken CreateToolhelp32Snapshot DeleteFileW IsDebuggerPresent Process32FirstW CopyFileW GetCommandLineW LoadLibraryExW GetStartupInfoW UnhandledExceptionFilter FindFirstFileW CreateFileW GetModuleFileNameW GetCommandLineA FindNextFileW CreateProcessW CreateThread GetFileSize OpenProcess FindResourceW GetSystemInfo GetSystemDirectoryW GetTickCount WriteFile FindFirstFileExW GetFileSizeEx GetTempPathW TerminateProcess LockResource LoadLibraryW GetFileAttributesW Process32NextW GetModuleHandleExW GetModuleHandleW GetProcAddress CreateDirectoryW ShellExecuteExW FindWindowExW GetWindowThreadProcessId SetSecurityDescriptorDacl RegOpenKeyW VirtualAlloc GetDriveTypeW GetModuleHandleA CreateFileMappingW Sleep GetNativeSystemInfo MapViewOfFile GetVersionExW OpenFileMappingW OutputDebugStringW ExitThread ShellExecuteW GetUpdateRect FindWindowW GetCursorPos WSAStartup DeviceIoControl RegEnumKeyExW GetTickCount64 StartServiceCtrlDispatcherW7f:T681,"360se.exe" wrote 00000004 bytes to a remote process "C:\Program Files\SogouInput\E84C2983\sgfeedbackhelper.exe" (Handle: 1208) "sgfeedbackhelper.exe" wrote 00000004 bytes to a remote process "C:\Program Files\SogouInput\E84C2983\sgfeedbackhelperz.exe" (Handle: 1348) "sgfeedbackhelperz.exe" wrote 00000004 bytes to a remote process "C:\Program Files\SogouInput\E84C2983\jzr.exe" (Handle: 684) "sgfeedbackhelperz.exe" wrote 00000004 bytes to a remote process "C:\Program Files\SogouInput\E84C2983\jzr.exe" (Handle: 696) "sgfeedbackhelperz.exe" wrote 00000004 bytes to a remote process "C:\Program Files\SogouInput\E84C2983\jzr.exe" (Handle: 672) "sgfeedbackhelperz.exe" wrote 00001000 bytes to a remote process "C:\Program Files\SogouInput\E84C2983\jzr.exe" (Handle: 672) "sgfeedbackhelperz.exe" wrote 00015000 bytes to a remote process "C:\Program Files\SogouInput\E84C2983\jzr.exe" (Handle: 672) "sgfeedbackhelperz.exe" wrote 00002000 bytes to a remote process "C:\Program Files\SogouInput\E84C2983\jzr.exe" (Handle: 672) "sgfeedbackhelperz.exe" wrote 00029000 bytes to a remote process "C:\Program Files\SogouInput\E84C2983\jzr.exe" (Handle: 672) "sgfeedbackhelperz.exe" wrote 00001000 bytes to a remote process "C:\Program Files\SogouInput\E84C2983\jzr.exe" (Handle: 684) "sgfeedbackhelperz.exe" wrote 00015000 bytes to a remote process "C:\Program Files\SogouInput\E84C2983\jzr.exe" (Handle: 684) "sgfeedbackhelperz.exe" wrote 00002000 bytes to a remote process "C:\Program Files\SogouInput\E84C2983\jzr.exe" (Handle: 684) "sgfeedbackhelperz.exe" wrote 00029000 bytes to a remote process "C:\Program Files\SogouInput\E84C2983\jzr.exe" (Handle: 684)80:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAjM3iIj////////4iIhwAAIzeIiI+IiIiIiI/4iIdwACN3iP//iId3d4iP//iIhwdzeI/4iId3d3d4iIj/iId4c4iPiHMzMzMzMzN4j/iIiHOIiIdzMzMzMzMzN4j/iIiHiIdzMzMzMzMzMzN4j/iIh3h3MzM3eIiIdzMzN4j/iIhzMzMzeIj/+IczMzN4/4iIgzMzN4iP//+IdzMzeP/4iIMzM3eP////+Ih3d3iP//+HMzN4j/////+IiIiIj///h3MzeP///////////////4hzM3iIiIiIiIiIiIj///iIgzM3d3d3d3d3d3d4iP/4iIczMzMzMzMzMzMzN4j/+Id3czMzMzMzMzMzMzeI//+Hd3M3d3d3d3dzMzM3iP//hzczeIiIiIiIhzMzOIj//4czM3iP/////4gzMziP+P+IczM3iP////iHMzN4//j/+IMzM3j///+IczM3eP/4j/+HMzN4iPiIhzMzOIj/iI//iHMzM3iIhzMzM3iP+IiI//iHczN3iIdzM3iI//iIiI//iIczM3iIdzd4//+Ih3iI//iIiHd3iIiIj//4iHB4iI///4iId3iIj///iIcwB3iI////iIiIiIiPiIh3MAB4iIj/////iHd4iIiHMzAAB3iIiI///4iHd4iHdzMwAAB4iIiIiIiIiHczMzMzPzAAD/8wAA/8AAAA/AAAAPwAAAA8AAAAPAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAAMAAAADAAAADwAAAA/AAAA/wAAAP/AAAP/wAAD//wAAD/8AAAw==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"718d8efde0ba4ba81ce3d1bf56a0e1a1acaace8f2dae94677473991b27276d91","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790429264050,"unified_at":"2026-09-26T13:27:44.050Z","metadata":{"hashes":{"sha256":"718d8efde0ba4ba81ce3d1bf56a0e1a1acaace8f2dae94677473991b27276d91","sha1":"6d5886d56c0b53d039a838f8944368938e81ca32","md5":"ec7cc3dd8c4aa4b562ba8c30854cef62","sha512":"5908fbed507e5e795228c91b5e80f03057562c34b0dbd15fcb87c3aa0bad31fd0aa3cf9663d99dd34fba022eca3c4963c911d33fb9ee403fa9773a3e76044abf","ssdeep":"196608:eU2hFGVP+q1y8vCB9Fl5sjnq26lHvBRWGm3PFFgoKp0Wcps5YqM8t:edIXCzFsjqhPB2Pwr00KJ8t","ssdeep_chunks":["196608:eU2hFGV","196608:U2hFGVP","196608:2hFGVP+","196608:hFGVP+q","196608:FGVP+q1","196608:GVP+q1y","196608:VP+q1y8","196608:P+q1y8v","196608:+q1y8vC","196608:q1y8vCB","196608:1y8vCB9","196608:y8vCB9F","196608:8vCB9Fl","196608:vCB9Fl5","196608:CB9Fl5s","196608:B9Fl5sj","196608:9Fl5sjn","196608:Fl5sjnq","196608:l5sjnq2","196608:5sjnq26","196608:sjnq26l","196608:jnq26lH","196608:nq26lHv","196608:q26lHvB","196608:26lHvBR","196608:6lHvBRW","196608:lHvBRWG","196608:HvBRWGm","196608:vBRWGm3","196608:BRWGm3P","196608:RWGm3PF","196608:WGm3PFF","196608:Gm3PFFg","196608:m3PFFgo","196608:3PFFgoK","196608:PFFgoKp","196608:FFgoKp0","196608:FgoKp0W","196608:goKp0Wc","196608:oKp0Wcp","196608:Kp0Wcps","196608:p0Wcps5","196608:0Wcps5Y","196608:Wcps5Yq","196608:cps5YqM","196608:ps5YqM8","196608:s5YqM8t","393216:eU2hFGV","393216:U2hFGVP","393216:2hFGVP+","393216:hFGVP+q","393216:FGVP+q1","393216:GVP+q1y","393216:VP+q1y8","393216:P+q1y8v","393216:+q1y8vC","393216:q1y8vCB","393216:1y8vCB9","393216:y8vCB9F","393216:8vCB9Fl","393216:vCB9Fl5","393216:CB9Fl5s","393216:B9Fl5sj","393216:9Fl5sjn","393216:Fl5sjnq","393216:l5sjnq2","393216:5sjnq26","393216:sjnq26l","393216:jnq26lH","393216:nq26lHv","393216:q26lHvB","393216:26lHvBR","393216:6lHvBRW","393216:lHvBRWG","393216:HvBRWGm","393216:vBRWGm3","393216:BRWGm3P","393216:RWGm3PF","393216:WGm3PFF","393216:Gm3PFFg","393216:m3PFFgo","393216:3PFFgoK","393216:PFFgoKp","393216:FFgoKp0","393216:FgoKp0W","393216:goKp0Wc","393216:oKp0Wcp","393216:Kp0Wcps","393216:p0Wcps5","393216:0Wcps5Y","393216:Wcps5Yq","393216:cps5YqM","393216:ps5YqM8","393216:s5YqM8t","196608:edIXCzF","196608:dIXCzFs","196608:IXCzFsj","196608:XCzFsjq","196608:CzFsjqh","196608:zFsjqhP","196608:FsjqhPB","196608:sjqhPB2","196608:jqhPB2P","196608:qhPB2Pw","196608:hPB2Pwr","196608:PB2Pwr0","196608:B2Pwr00","196608:2Pwr00K","196608:Pwr00KJ","196608:wr00KJ8","196608:r00KJ8t"],"imphash":"058f6c75643bf3feee0b575776a664e2"},"file_info":{"file_name":"360se.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":11593952,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1770541508000,"last_seen":1770561933000,"last_multi_scan":1770561933000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["modular","criminal","rat","changemerat","trojan","windows-server-utility","evasive","RAT"]},"stats":{"av":{"malicious_count":6,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":98},"sandbox_signatures":{"informative_count":258,"suspicious_count":19,"malicious_count":19,"total":296},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Application.Jaik.48443","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Agent.BO potentially unwanted application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.sa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_51.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Agent.BO potentially unwanted application","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Able to use GrayString API for text rendering"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"malicious","value":"Modifies the UAC/LUA settings (Account Control)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to create a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Tries to save executable or command in registry"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"},{"type":"informative","value":"Possible DLL sideloading"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Persistence","technique":"Change Default File Association","attack_id":"T1546.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/001","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Reference explorer.exe process"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"suspicious","value":"Able to check if a debugger is running"},{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"YARA signature match - AES encryption"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"malicious","value":"Tries to disable Windows defender Anti Spyware"},{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"malicious","value":"PE file contains executable resources"},{"type":"suspicious","value":"Section contains high entropy"},{"type":"informative","value":"YARA signature match – Embedded PE executable"},{"type":"informative","value":"YARA signature match - PE executable embedded in .rsrc section"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Defense Evasion","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to retrieve browser cookies data"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"malicious","value":"Hooks process/system information retrieval APIs"},{"type":"malicious","value":"Hooks internet related APIs"},{"type":"malicious","value":"Sets a global windows hook to intercept mouse events"},{"type":"informative","value":"Sets a windows hook"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Able to retrieve the valid logical drives on the computer"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains references to file movement (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads VM-specific registry key"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to open handle to a named event object (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to query the machine timezone"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"malicious","value":"Reads Antivirus engine related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to move file or directory"},{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Lateral Movement","technique":"Cloud Services","attack_id":"T1021.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/007","identifiers":[{"type":"informative","value":"Able to connect to a cloud service"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Contains ability to perform remote procedure calls (API string)"},{"type":"informative","value":"Contains ability to register RPC protocol sequence (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Creates directory on disk"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Collection","technique":"Archive via Utility","attack_id":"T1560.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/001","identifiers":[{"type":"informative","value":"YARA signature match - Detects 7zip files"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contacts server"},{"type":"suspicious","value":"Spawned process connects to a network"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Drops executable files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Attempts to call internet-related API for network communication"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"malicious","value":"Sends network traffic on a port typically used by IRC"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"malicious","value":"Known malware detected"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"tactic":"Impact","technique":"Disk Content Wipe","attack_id":"T1561.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1561/001","identifiers":[{"type":"informative","value":"Contains ability to format disks"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"bad compression\" (Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")\n Found string \"unknown compression method\" (Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00001248.00000001.310177.00400000.00000040.mdmp\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"360se.exe\" called \"FindResourceW\" with parameter \"501\" - (UID: 00000000-00003552)\n \"360se.exe\" called \"FindResourceW\" with parameter \"503\" - (UID: 00000000-00003552)\n \"360se.exe\" called \"FindResourceW\" with parameter \"504\" - (UID: 00000000-00003552)\n \"360se.exe\" called \"FindResourceW\" with parameter \"500\" - (UID: 00000000-00003552)\n \"360se.exe\" called \"FindResourceW\" with parameter \"502\" - (UID: 00000000-00003552)\n \"sgfeedbackhelper.exe\" called \"FindResourceW\" with parameter \"101\" - (UID: 00000000-00007764)\n \"sgfeedbackhelperz.exe\" called \"FindResourceW\" with parameter \"101\" - (UID: 00000000-00003376)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"360se.exe\" called \"LoadResource with parameter {'hModule': '9502720', 'hResInfo': '9953696'}\" (UID: 00000000-00003552)\n \"360se.exe\" called \"LoadResource with parameter {'hModule': '9502720', 'hResInfo': '9953728'}\" (UID: 00000000-00003552)\n \"360se.exe\" called \"LoadResource with parameter {'hModule': '9502720', 'hResInfo': '9953744'}\" (UID: 00000000-00003552)\n \"360se.exe\" called \"LoadResource with parameter {'hModule': '9502720', 'hResInfo': '9953680'}\" (UID: 00000000-00003552)\n \"360se.exe\" called \"LoadResource with parameter {'hModule': '9502720', 'hResInfo': '9953712'}\" (UID: 00000000-00003552)\n \"sgfeedbackhelper.exe\" called \"LoadResource with parameter {'hModule': '16449536', 'hResInfo': '18519240'}\" (UID: 00000000-00007764)\n \"sgfeedbackhelperz.exe\" called \"LoadResource with parameter {'hModule': '14483456', 'hResInfo': '16553160'}\" (UID: 00000000-00003376)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"RtlCreateUserThread\" (Indicator: \"RtlCreateUserThread\"; File: \"360se.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"360se.exe\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"360se.exe\")\n Found reference to API \"NtOpenProcessTokenEx\" (Indicator: \"OpenProcessToken\"; File: \"360se.exe\")\n Found reference to API \"NtOpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"360se.exe\")\n Found reference to API \"NtOpenThreadTokenEx\" (Indicator: \"OpenThreadToken\"; File: \"360se.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001248.00000001.310177.010D8000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"360se.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001248.00000001.310177.00400000.00000040.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001248.00000001.310177.00400000.00000040.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform remote procedure calls (API string)","description":"Found reference to API \"RpcServerRegisterIf\" (Indicator: \"RpcServerRegisterIf\"; File: \"360se.exe\")\n Found reference to API \"RpcServerListen\" (Indicator: \"RpcServerListen\"; File: \"360se.exe\")\n Found reference to API \"RpcServerUseProtseqEpW\" (Indicator: \"RpcServerUse\"; File: \"360se.exe\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-160","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"360se.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"360se.exe\")\n Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00001248.00000001.310177.00400000.00000040.mdmp\")\n Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SHA512 block transform for x86, CRYPTOGAMS by \" (Indicator: \"SHA512\"; File: \"360se.exe\")\n Found reference to \"SHA384\" (Indicator: \"SHA384\"; File: \"360se.exe\")\n Found reference to \"SHA512\" (Indicator: \"SHA512\"; File: \"360se.exe\")\n Found reference to \"SP800_108_CTR_HMAC\" (Indicator: \"HMAC\"; File: \"360se.exe\")\n file/memory contains long string with (Indicator: \"SHA512\"; File: \"7z.exe\")\n Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00003376.00000001.308317.732F9000.00000002.mdmp\")\n Found reference to \"SHA512\" (Indicator: \"SHA512\"; Source: \"00000000-00003376.00000001.308317.732F9000.00000002.mdmp\")\n Found reference to \"SP800_108_CTR_HMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00003376.00000001.308317.732F9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"$2b","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\PhysicalDrive%d; Source: \"360se.exe\")\n Found string - \\\\.\\Scsi%d:; Source: \"360se.exe\")\n Found string - \\\\.\\360SelfProtection; Source: \"360se.exe\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2d","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\"360se.exe\" renamed original file\"C:\\360se.exe\" to \"%TEMP%\\1770570338\\....\\TemporaryFile\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"360se.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"360se.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"360se.exe\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"360se.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"360se.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"360se.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"360se.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"360se.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"360se.exe\")\n Found reference to API \"RtlUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"360se.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"$2e","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"$2f","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$30","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"$31","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$32","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; File: \"360se.exe\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"360se.exe\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00003376.00000001.308317.732F9000.00000002.mdmp\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00003376.00000001.308317.732F9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$34","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$35","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"jzr.exe\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"360se.exe\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001248.00000001.310177.010D8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"jzr.exe\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"360se.exe\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001248.00000001.310177.010D8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"360se.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"360se.exe\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"360se.exe\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; File: \"360se.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"360se.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"360se.exe\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"360se.exe\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"$38","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; File: \"360se.exe\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; File: \"360se.exe\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"360se.exe\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"360se.exe\")\n Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"360se.exe\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"360se.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00003552)\n \"sgfeedbackhelper.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007764)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"360se.exe\" called \"Process32FirstW\" with parameters (UID: 00000000-00003552)\n \"360se.exe\" called \"Process32NextW\" with parameters (UID: 00000000-00003552)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"360se.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003552)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"sgfeedbackhelper.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007764)\n \"sgfeedbackhelperz.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003376)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"sgfeedbackhelperz.exe\" called \"IsWow64Process\" with parameter \"3376\" - (UID: 00000000-00003376)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"sgfeedbackhelper.exe\" called \"GetWindowTextW\" (UID: 00000000-00007764)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"360se.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003552)\n \"sgfeedbackhelper.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007764)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$3b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"sgfeedbackhelper.exe\" called \"OpenMutexW\" with parameter \"Local\\sgime_user_lock\" - (UID: 00000000-00007764)\n \"sgfeedbackhelper.exe\" called \"OpenMutexW\" with parameter \"SGDOWNLOADCEF_b0fc18ef-f93f-409c-a99d-6e2174843427\" - (UID: 00000000-00007764)\n \"sgfeedbackhelperz.exe\" called \"OpenMutexW\" with parameter \"Local\\sgime_user_lock\" - (UID: 00000000-00003376)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$3c","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"sgfeedbackhelper.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00007764)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"sgfeedbackhelper.exe\" called \"GetLocaleInfoW\" with parameter \"2048\" - (UID: 00000000-00007764)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: 360se.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: sgfeedbackhelperz.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: 7z.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: jzr.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"$3d","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"360se.exe\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; File: \"360se.exe\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.DLL at 00000000-00003552-49648-747-00936F80\n FindNextFileW@KERNEL32.DLL at 00000000-00003552-49648-900-00926E60\n FindFirstFileW@KERNEL32.DLL at 00000000-00003552-49648-903-00926EC0\n FindNextFileW@KERNEL32.DLL at 00000000-00003552-49648-1143-00923710\n FindFirstFileExW@KERNEL32.DLL at 00000000-00003552-49648-1557-00952A0D\n FindFirstFileW@KERNEL32.DLL at 00000000-00007764-53975-3775-0100E860\n FindFirstFileW@KERNEL32.DLL at 00000000-00007764-53975-3782-0100E5A0\n FindFirstFileExW@KERNEL32.DLL at 00000000-00007764-53975-7916-0110CC53\n FindFirstFileW@KERNEL32.DLL at 00000000-00003376-60889-3775-00E2E860\n FindFirstFileW@KERNEL32.DLL at 00000000-00003376-60889-3782-00E2E5A0\n FindFirstFileExW@KERNEL32.DLL at 00000000-00003376-60889-7916-00F2CC53","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeW@KERNEL32.DLL at 00000000-00007764-53975-4355-01106CEF\n GetDriveTypeW@KERNEL32.DLL at 00000000-00003376-60889-4355-00F26CEF","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"360se.exe\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"360se.exe\")\n Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; Source: \"00000000-00001248.00000001.310177.00400000.00000040.mdmp\")\n Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; Source: \"00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"360se.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"360se.exe\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"360se.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001248.00000001.310177.010D8000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"FileTimeToSystemTime@KERNEL32.DLL at 00000000-00003552-49648-430-00942BDF\n FileTimeToSystemTime@KERNEL32.DLL at 00000000-00003552-49648-438-009417F0\n FileTimeToSystemTime@KERNEL32.DLL at 00000000-00003552-49648-439-00941870\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003552-49648-1493-00945577\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007764-53975-3650-010F17C8\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007764-53975-4272-010E53F6\n FileTimeToSystemTime@KERNEL32.DLL at 00000000-00007764-53975-5191-0101AC10\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007764-53975-7823-010E6A55\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003376-60889-3650-00F117C8\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003376-60889-4272-00F053F6\n FileTimeToSystemTime@KERNEL32.DLL at 00000000-00003376-60889-5191-00E3AC10\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003376-60889-7823-00F06A55","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"$3e","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00000000-00003552-49648-1015-00922BB0\n GetTimeZoneInformation@KERNEL32.DLL at 00000000-00007764-53975-4420-010FF6AA\n GetTimeZoneInformation@KERNEL32.DLL at 00000000-00007764-53975-5020-0102FB70\n GetTimeZoneInformation@KERNEL32.DLL at 00000000-00003376-60889-4420-00F1F6AA\n GetTimeZoneInformation@KERNEL32.DLL at 00000000-00003376-60889-5020-00E4FB70","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00000000-00007764-53975-1172-0106E130\n GetVersionExW@KERNEL32.DLL at 00000000-00007764-53975-4380-00FFA510\n GetVersionExW@KERNEL32.DLL at 00000000-00007764-53975-5354-01020180\n GetVersionExW@KERNEL32.DLL at 00000000-00003376-60889-1172-00E8E130\n GetVersionExW@KERNEL32.DLL at 00000000-00003376-60889-4380-00E1A510\n GetVersionExW@KERNEL32.DLL at 00000000-00003376-60889-5354-00E40180","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"$3f","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"360se.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"360se.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"sgfeedbackhelper.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"sgfeedbackhelper.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"sgfeedbackhelperz.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"sgfeedbackhelperz.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"jzr.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set reg no name\" (Indicator: \"set \"; File: \"00000000-00007764.00000000.307984.00FB1000.00000020.mdmp\")\n Found string \"set reg no value\" (Indicator: \"set \"; File: \"00000000-00007764.00000000.307984.00FB1000.00000020.mdmp\")\n Found string \"set env no name\" (Indicator: \"set \"; File: \"00000000-00007764.00000000.307984.00FB1000.00000020.mdmp\")\n Found string \"set env no value\" (Indicator: \"set \"; File: \"00000000-00007764.00000000.307984.00FB1000.00000020.mdmp\")\n Found string \"set env invalid name\" (Indicator: \"set \"; File: \"00000000-00007764.00000000.307984.00FB1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.DLL at 00000000-00003552-49648-773-00934F30\n GetSystemInfo@KERNEL32.DLL at 00000000-00003552-49648-815-00931EE0\n GetNativeSystemInfo@KERNEL32.DLL at 00000000-00007764-53975-4380-00FFA510\n GetNativeSystemInfo@KERNEL32.DLL at 00000000-00003376-60889-4380-00E1A510","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"360se.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"360se.exe\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"360se.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001248.00000001.310177.010D8000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"360se.exe\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"360se.exe\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00001248.00000001.310177.00400000.00000040.mdmp\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetKeyboardLayout@USER32.DLL at 00000000-00007764-53975-1817-010DB240\n GetKeyboardLayout@USER32.DLL at 00000000-00003376-60889-1817-00EFB240","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"360se.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"$43","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsA\" (Indicator: \"PathFileExist\"; Source: \"00000000-00001248.00000001.310177.00400000.00000040.mdmp\")\n Found reference to API \"PathFileExistsA\" (Indicator: \"PathFileExist\"; Source: \"00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, FFFFFFFFh\" and \"je 010FF7D6h\" at 00000000-00007764-53975-4420-010FF6AA\n Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, FFFFFFFFh\" and \"je 0102FBE3h\" at 00000000-00007764-53975-5020-0102FB70\n Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, FFFFFFFFh\" and \"je 00F1F7D6h\" at 00000000-00003376-60889-4420-00F1F6AA\n Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, FFFFFFFFh\" and \"je 00E4FBE3h\" at 00000000-00003376-60889-5020-00E4FB70","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %PROGRAMFILES%\\SOGOUINPUT\\E84C2983\\HWSIGNATURE.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"360se.exe\" queries volume information of \"C:\\\" at 00000000-00003552-00000C17-3772626278","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"360se.exe\" queries volume information of \"C:\\\" at 00000000-00003552-00000C17-3772626278","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"360se.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"sgfeedbackhelper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"360se.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\360SE.EXE\")\n \"sgfeedbackhelper.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SGFEEDBACKHELPERZ.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"sgfeedbackhelper.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to retrieve device driver information","description":"\"360se.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SANDBOXFLTR\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1652","relevance":1,"id":"registry-174","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyW\" in file \"360se.exe\"\n Found registry modification API: \"RegCreateKeyExW\" in file \"360se.exe\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00001248.00000001.310177.00400000.00000040.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00001248.00000001.310177.00400000.00000040.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp\"\n Found registry modification API: \"RegCreateKeyW\" in \"00000000-00003376.00000001.308317.732F9000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"360se.exe\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"360se.exe\")\n Found string \"MoveFileWithProgressW\" (Indicator: \"MoveFileW\"; File: \"360se.exe\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00001248.00000001.310177.00400000.00000040.mdmp\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"jzr.exe\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00001248.00000001.310177.00400000.00000040.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00001248.00000001.310177.010D8000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Able to use GrayString API for text rendering","description":"Found reference to API \"GrayStringA\" (Indicator: \"GrayStringA\"; Source: \"00000000-00001248.00000001.310177.00400000.00000040.mdmp\")\n Found reference to API \"GrayStringA\" (Indicator: \"GrayStringA\"; Source: \"00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-900","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"360se.exe\" called \"CopyFileW\" to copy C:\\\\360se.exe to new location %PROGRAMFILES%\\SogouInput\\E84C2983\\bzzbynMgNedca.exe (UID: 00000000-00003552)\n \"360se.exe\" called \"CopyFileW\" to copy %WINDIR%\\SysWOW64\\svchost.exe to new location %PROGRAMFILES%\\SogouInput\\E84C2983\\jzr.exe (UID: 00000000-00003552)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$44","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"360se.exe\" called \"CreateProcessW\" with parameter \"%PROGRAMFILES%\\SogouInput\\E84C2983\\sgfeedbackhelper.exe\" - (UID: 00000000-00003552)\n \"sgfeedbackhelper.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\SogouInput\\E84C2983\\sgfeedbackhelperz.exe\" MdGTPh\" - (UID: 00000000-00007764)\n \"sgfeedbackhelperz.exe\" called \"CreateProcessW\" with parameter \"%PROGRAMFILES%\\SogouInput\\E84C2983\\jzr.exe\" - (UID: 00000000-00003376)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$45","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"\"360se.exe\" called \"MoveFileW\" with parameter C:\\\\360se.exe & %TEMP%\\1770570338\\....\\TemporaryFile (UID: 00000000-00003552)\n \"360se.exe\" called \"MoveFileW\" with parameter %TEMP%\\1770570338\\....\\ & %TEMP%\\1770570338\\TemporaryFile (UID: 00000000-00003552)","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$46","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"154.91.64.65:6666\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"360se.exe.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"360se.exe\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"360se.exe\")\n Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcess\"; File: \"360se.exe\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001248.00000001.310177.00400000.00000040.mdmp\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"360se.exe\")\n Found reference to API \"CreateDirectoryAndGetError\" (Indicator: \"CreateDirectory\"; File: \"360se.exe\")\n Found reference to API \"NtCreateDirectoryObject\" (Indicator: \"CreateDirectory\"; File: \"360se.exe\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00001248.00000001.310177.00400000.00000040.mdmp\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"360se.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"$48","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"360se.exe\")\n Found reference to API \"RegDisablePredefinedCacheEx\" (Indicator: \"RegDisablePredefinedCache\"; File: \"360se.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001248.00000001.310177.00400000.00000040.mdmp, 00000000-00001248.00000001.310177.010D8000.00000002.mdmp\")\n Found reference to API \"RegDisablePredefinedCacheEx\" (Indicator: \"RegDisablePredefinedCache\"; Source: \"00000000-00001248.00000001.310177.010D8000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"$49","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"360se.exe\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"360se.exe\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"360se.exe\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"360se.exe\")\n Found reference to API \"MoveFileWithProgressW\" (Indicator: \"MoveFile\"; File: \"360se.exe\")\n Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00001248.00000001.310177.00400000.00000040.mdmp\")\n Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Contains ability to open handle to a named event object (API string)","description":"Found reference to API \"NtOpenEvent\" (Indicator: \"NtOpenEvent\"; File: \"360se.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-467","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartServiceCtrlDispatcher\"; File: \"360se.exe\")\n Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartService\"; File: \"360se.exe\")\n Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartServiceCtrlDispatcher\"; Source: \"00000000-00001248.00000001.310177.010D8000.00000002.mdmp\")\n Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartService\"; Source: \"00000000-00001248.00000001.310177.010D8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"7z.dll\" contains export function called \"CreateDecoder\" at ordinal 1\n \"7z.dll\" contains export function called \"CreateEncoder\" at ordinal 2\n \"7z.dll\" contains export function called \"CreateObject\" at ordinal 3\n \"7z.dll\" contains export function called \"GetHandlerProperty\" at ordinal 5\n \"7z.dll\" contains export function called \"GetHandlerProperty2\" at ordinal 4\n \"7z.dll\" contains export function called \"GetHashers\" at ordinal 6\n \"7z.dll\" contains export function called \"GetIsArc\" at ordinal 7\n \"7z.dll\" contains export function called \"GetMethodProperty\" at ordinal 8\n \"7z.dll\" contains export function called \"GetModuleProp\" at ordinal 9\n \"7z.dll\" contains export function called \"GetNumberOfFormats\" at ordinal 10\n \"7z.dll\" contains export function called \"GetNumberOfMethods\" at ordinal 11\n \"7z.dll\" contains export function called \"SetCaseSensitive\" at ordinal 12\n \"7z.dll\" contains export function called \"SetCodecs\" at ordinal 13\n \"7z.dll\" contains export function called \"SetLargePageMode\" at ordinal 14","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$50","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"360se.exe\")\n Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileW in import section (Source: 360se.exe)\n Found MoveFileExW in import section (Source: sgfeedbackhelperz.exe)\n Found MoveFileW in import section (Source: 7z.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$51","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"$52","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$53","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"360se.exe\" failed to load missing module \"C:\\Kernel32.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"360se.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"sgfeedbackhelperz.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"7z.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"7z.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"jzr.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"appro@openssl.org\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - h\\\\.\\pipe\\%ls\\%ls\n Found string - \\\\.\\pipe\\_sogoutool_multithreading_pipenew2","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$54","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$55","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"360se.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 742A0000\n \"360se.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 734E0000\n \"sgfeedbackhelper.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 742A0000\n \"sgfeedbackhelper.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 734E0000\n \"sgfeedbackhelperz.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 742A0000\n \"sgfeedbackhelperz.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 734E0000\n \"jzr.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 742A0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"360se.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74550000\n \"sgfeedbackhelper.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74550000\n \"sgfeedbackhelperz.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74550000\n \"jzr.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74550000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$56","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$57","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"360se.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"sgfeedbackhelperz.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"jzr.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"360se.exe\" has an executable section named \".text\"\n \"sgfeedbackhelperz.exe\" has an executable section named \".text\"\n \"7z.dll\" has an executable section named \".text\"\n \"7z.exe\" has an executable section named \".text\"\n \"jzr.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"360se.exe\" has an writable section named \".data\"\n \"sgfeedbackhelperz.exe\" has an writable section named \".data\"\n \"7z.dll\" has an writable section named \".data\"\n \"7z.dll\" has an writable section named \".sxdata\"\n \"7z.exe\" has an writable section named \".data\"\n \"7z.exe\" has an writable section named \".sxdata\"\n \"jzr.exe\" has an writable section named \".data\"\n \"jzr.exe\" has an writable section named \".didat\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$58","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".rsrc\" is \"0xa93000\" greater than 0x100000\n Raw size of \".text\" is \"0x179600\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x128e00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".rsrc\" is \"0xa93000\" greater than 0x100000\n Virtual size of \".text\" is \"0x17942a\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x128cf0\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\svchost.exe\" [Source: 00000000-00003552-00000C3D-2007692552]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"sgfeedbackhelper.exe\" (UID: 00000000-00007764) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"sgfeedbackhelper.exe\" (UID: 00000000-00007764) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$59","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\SYSTEM32\\DINPUT8.dll\" [Source: 00000000-00007764-0000044E-6187947172]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"sgfeedbackhelperz.exe\" searching for class \"E4ED2A98_70F1_4A86_902E_D1877E2CE298_SGFeedbackMain\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Sets a windows hook","description":"\"sgfeedbackhelper.exe\" sets a windows hook with filter \"WH_MOUSE\" for thread ID 7032\n \"sgfeedbackhelper.exe\" sets a windows hook with filter \"WH_KEYBOARD\" for thread ID 7032\n \"sgfeedbackhelper.exe\" sets a global windows hook with filter \"WH_MOUSE_LL\"","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-71","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"sgfeedbackhelper.exe\" (UID: 00000000-00007764)\n Spawned process \"sgfeedbackhelperz.exe\" with commandline \"MdGTPh\" (UID: 00000000-00003376)\n Spawned process \"jzr.exe\" (UID: 00000000-00007704)\n Spawned process \"jzr.exe\" (UID: 00000000-00001248)\n Spawned process \"jzr.exe\" (UID: 00000000-00007656)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"sgfeedbackhelper.exe\" (UID: 00000000-00007764)\n Spawned process \"sgfeedbackhelperz.exe\" with commandline \"MdGTPh\" (UID: 00000000-00003376)\n Spawned process \"jzr.exe\" (UID: 00000000-00007704)\n Spawned process \"jzr.exe\" (UID: 00000000-00001248)\n Spawned process \"jzr.exe\" (UID: 00000000-00007656)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$5a","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"360se.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"sgfeedbackhelperz.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"7z.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"7z.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"jzr.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"RegisterServiceCtrlHandlerW\" (Indicator: \"RegisterServiceCtrlHandler\"; File: \"360se.exe\")\n Found reference to API \"RegisterServiceCtrlHandlerW\" (Indicator: \"RegisterServiceCtrlHandler\"; Source: \"00000000-00001248.00000001.310177.010D8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"360se.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"sgfeedbackhelper.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$5c","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$5d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"ImageMagik.dll\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections\"- Location: [%PROGRAMFILES%\\SogouInput\\E84C2983\\ImageMagik.dll]- [targetUID: 00000000-00007764]\n \"HWSignature.dll\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections\"- Location: [%PROGRAMFILES%\\SogouInput\\E84C2983\\HWSignature.dll]- [targetUID: 00000000-00007764]\n \"7z.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 6 sections\"- Location: [%PROGRAMFILES%\\SogouInput\\E84C2983\\7z.dll]- [targetUID: 00000000-00003552]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"360se.exe\" queries basic process information of the \"C:\\360se.exe\" (UID: 3552)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$5e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"360se.exe\" reads file \"c:\\360se.exe\"\n \"360se.exe\" reads file \"c:\\360se.exe:zone.identifier\"\n \"360se.exe\" reads file \"c:\\windows\\syswow64\\svchost.exe\"\n \"360se.exe\" reads file \"c:\\program files\\sogouinput\\e84c2983\\1.zip\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$5f","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"360se.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"360se.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"360se.exe\" trying to touch file \"C:\\360se.exe\"\n \"360se.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"360se.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"360se.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"360se.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"360se.exe\" trying to touch file \"C:\\360SE.EXE.LOCAL\"\n \"360se.exe\" trying to touch file \"C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_d0271d135f36f548\\comctl32.dll\"\n \"360se.exe\" trying to touch file \"C:\\BCRYPT.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"$60","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$61","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"360se.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\BZZBYNMG.LNK\"\n \"360se.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\bzzbynMg.lnk\"\n \"360se.exe\" trying to access LNK file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\BZZBYNMG.LNK\"\n \"360se.exe\" trying to access LNK file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\bzzbynMg.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$62","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$63","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"360se.exe\" writes file \"c:\\program files\\sogouinput\\e84c2983\\asvv.txt\"\n \"360se.exe\" writes file \"c:\\program files\\sogouinput\\e84c2983\\shouhu.txt\"\n \"360se.exe\" writes file \"c:\\program files\\sogouinput\\e84c2983\\1.zip\"\n \"360se.exe\" writes file \"c:\\program files\\sogouinput\\e84c2983\\bzzbynmgnedca.exe\"\n \"360se.exe\" writes file \"c:\\program files\\sogouinput\\e84c2983\\bzzbynmgnedca.exe:zone.identifier\"\n \"360se.exe\" writes file \"c:\\program files\\sogouinput\\e84c2983\\jzr.exe\"\n \"360se.exe\" writes file \"c:\\program files\\sogouinput\\e84c2983\\7z.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"360se.exe\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"360se.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; File: \"360se.exe\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSACleanup\" (Indicator: \"wsacleanup\"; File: \"360se.exe\")\n Found reference to API \"gethostbyname\" (Indicator: \"gethostbyname\"; File: \"360se.exe\")\n Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; File: \"360se.exe\")\n Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"360se.exe\")\n Found reference to API \"[client] t_toolStuAsync::RequestToolStart Send OK\" (Indicator: \" send \"; File: \"00000000-00007764.00000000.307984.00FB1000.00000020.mdmp\")\n Found reference to API \"[client] n_ProcessStart::CheckParam Recv Task:\" (Indicator: \" recv \"; File: \"00000000-00007764.00000000.307984.00FB1000.00000020.mdmp\")\n Found reference to API \"[client] n_ProcessStart::CheckParam Recv Task:\" (Indicator: \" recv \"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")\n Found reference to API \"[client] t_toolStuAsync::RequestToolStart Send OK\" (Indicator: \" send \"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"0.0.0.0\"\n \"10.16.16.37\"\n Potential IP \"127.0.0.1\" found in string \"http://127.0.0.1/%s\"\n \"1.0.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$64","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$65","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; File: \"360se.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://pinyin.sogou.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"7z.dll\"\n YARA signature for AES encryption matched on process \"00000000-00003376\"\n YARA signature for AES encryption matched on process \"00000000-00007764\"\n YARA signature for AES encryption matched on file \"sgfeedbackhelper.exe\"\n YARA signature for AES encryption matched on file \"sgfeedbackhelperz.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Detects 7zip files","description":"YARA signature for 7-Zip file file \"7z.exe\"","origin":"YARA Signature","mitre_attack_id":"T1560.001","relevance":1,"id":"yara-176","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"ImageMagik.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PE executable embedded in .rsrc section","description":"YARA signature for embedded PE executable in .rsrc section matched on file \"bzzbynMgNedca.exe\"\n YARA signature for embedded PE executable in .rsrc section matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":5,"id":"yara-26","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in process \"00000000-00007764\"\n YARA signature matched on embedded PE in process \"00000000-00007704\"\n YARA signature matched on embedded PE in file \"bzzbynMgNedca.exe\"\n YARA signature matched on embedded PE in file \"sample.bin\"\n YARA signature matched on embedded PE in process \"00000000-00001248\"\n YARA signature matched on embedded PE in file \"sgfeedbackhelper.exe\"\n YARA signature matched on embedded PE in file \"sgfeedbackhelperz.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Remote Access Related","name":"Able to connect to a cloud service","description":"$66","origin":"File/Memory","mitre_attack_id":"T1021.007","relevance":1,"id":"string-767","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to register RPC protocol sequence (API string)","description":"Found reference to API \"RpcServerUseProtseqEpW\" (Indicator: \"RpcServerUseProtseq\"; File: \"360se.exe\")\n Found reference to API \"RpcServerUseProtseqEpW\" (Indicator: \"RpcServerUseProtseq\"; Source: \"00000000-00001248.00000001.310177.010D8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-454","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"DragQueryFileW\" (File: \"360se.exe\")\n Found string \"GetClipboardData\" (Source: \"00000000-00007764-00000C2C-3775411024\")\n Found string \"DragQueryFileW\" (Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; File: \"360se.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; File: \"360se.exe\")\n Found reference to API \"RtlGetNtVersionNumbers\" (Indicator: \"RtlGetNtVersionNumbers\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 360se.exe]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: sgfeedbackhelperz.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$67","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve the valid logical drives on the computer","description":"Observed import api \"GetLogicalDriveStringsW\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: 7z.exe]","origin":"Static Parser","mitre_attack_id":"T1083","relevance":5,"id":"static-192","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"360se.exe\" tries to directly access volume data \"Z:\"\n \"sgfeedbackhelper.exe\" tries to directly access volume data \"Z:\"\n \"sgfeedbackhelper.exe\" tries to directly access volume data \"B:\"\n \"sgfeedbackhelper.exe\" tries to directly access volume data \"D:\"\n \"sgfeedbackhelper.exe\" tries to directly access volume data \"E:\"\n \"sgfeedbackhelper.exe\" tries to directly access volume data \"F:\"\n \"sgfeedbackhelper.exe\" tries to directly access volume data \"G:\"\n \"sgfeedbackhelper.exe\" tries to directly access volume data \"H:\"\n \"sgfeedbackhelper.exe\" tries to directly access volume data \"I:\"\n \"sgfeedbackhelper.exe\" tries to directly access volume data \"J:\"\n \"sgfeedbackhelper.exe\" tries to directly access volume data \"K:\"\n \"sgfeedbackhelper.exe\" tries to directly access volume data \"L:\"\n \"sgfeedbackhelper.exe\" tries to directly access volume data \"M:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"\"360se.exe\" called \"FindFirstFileW\" with parameter %TEMP%\\1770570338\\*.* (UID: 00000000-00003552)\n \"360se.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00003552)\n \"360se.exe\" called \"FindNextFileW\" with parameter TemporaryFile (UID: 00000000-00003552)\n \"360se.exe\" called \"FindFirstFileW\" with parameter %TEMP%\\1770570338\\TemporaryFile\\*.* (UID: 00000000-00003552)\n \"sgfeedbackhelper.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00007764)\n \"sgfeedbackhelperz.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00003376)\n \"sgfeedbackhelperz.exe\" called \"FindNextFileW\" with parameter sgfeedbackhelper_7764.log (UID: 00000000-00003376)\n \"jzr.exe\" called \"FindFirstFileA\" with parameter %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\\\FaCveHBxN*.* (UID: 00000000-00001248)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"360se.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"360se.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"15\"\n \"th32ProcessID\": \"0\"}\n \"sgfeedbackhelper.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"sgfeedbackhelper.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"360se.exe\" called \"GetComputerNameW\" (UID: 00000000-00003552)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"sgfeedbackhelper.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$69","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: sgfeedbackhelperz.exe)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"360se.exe\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; File: \"360se.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"360se.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; File: \"360se.exe\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"360se.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001248.00000001.310177.00400000.00000040.mdmp, 00000000-00001248.00000001.310177.010D8000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; File: \"360se.exe\")\n Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; Source: \"00000000-00001248.00000001.310177.00400000.00000040.mdmp\")\n Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; Source: \"00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"360se.exe\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"360se.exe\")\n Found reference to API \"GetModuleFileName failed!\" (Indicator: \"GetModuleFileName\"; File: \"00000000-00007764.00000000.307984.00FB1000.00000020.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001248.00000001.310177.00400000.00000040.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp\")\n Found reference to API \"GetModuleFileName failed!\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"360se.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"360se.exe\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00001248.00000001.310177.00400000.00000040.mdmp\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"360se.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00001248.00000001.310177.00400000.00000040.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"360se.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"360se.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001248.00000001.310177.00400000.00000040.mdmp, 00000000-00001248.00000001.310177.010D8000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001248.00000001.310177.010D8000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"360se.exe\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; File: \"00000000-00007764.00000000.307984.00FB1000.00000020.mdmp\")\n Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"passwords\" (Indicator: \"password\"; File: \"360se.exe\")\n Found string \"password\" (Indicator: \"password\"; File: \"00000000-00007764.00000000.307984.00FB1000.00000020.mdmp\")\n Found string \"passwordchar\" (Indicator: \"password\"; File: \"00000000-00007764.00000000.307984.00FB1000.00000020.mdmp\")\n Found string \"password\" (Indicator: \"password\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")\n Found string \"passwordchar\" (Indicator: \"password\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\360safe.exe\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 360se.exe\n \"Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\360se6.exe\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 360se.exe\n \"Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\IEXPLORE.EXE\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 360se.exe","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"L[f9]\" (Indicator: \"[F9]\"; File: \"360se.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"sgfeedbackhelper.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyExW\" in file \"360se.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"$70","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 360se.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: sgfeedbackhelperz.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 7z.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: jzr.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\\" (Indicator: \"\\Device\\\"; File: \"360se.exe\")\n Found string \"\\Device\\HarddiskVolume\" (Indicator: \"\\Device\\\"; File: \"360se.exe\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00001248.00000000.308256.00F40000.00000004.mdmp, 00000000-00001248.00000001.310177.00F40000.00000004.mdmp, 00000000-00001248.00000002.312096.00F40000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00003376.00000000.308171.03810000.00000004.mdmp, 00000000-00003376.00000001.308317.03810000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00003552.00000000.307136.039D0000.00000004.mdmp, 00000000-00003552.00000001.307698.039D0000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003552.00000000.307136.039D0000.00000004.mdmp, 00000000-00003552.00000001.307698.039D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; File: \"360se.exe\")\n Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; File: \"360se.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$71","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"System Security","name":"Contains ability to format disks","description":"Found string \"format specifier requires numeric argument\" (Indicator: \"format \"; File: \"00000000-00007764.00000000.307984.00FB1000.00000020.mdmp\")\n Found string \"format specifier requires signed argument\" (Indicator: \"format \"; File: \"00000000-00007764.00000000.307984.00FB1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1561.001","relevance":1,"id":"string-407","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"$72","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"360se.exe\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"360se.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"360se.exe\")\n Found reference to API \"@SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"360se.exe\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; File: \"360se.exe\")\n Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"00000000-00003552.00000001.307698.00911000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"NtSetInformationFile\" (Indicator: \"SetInformationFile\"; File: \"360se.exe\")\n Found reference to API \"NtSetInformationFile\" (Indicator: \"NtSetInformationFile\"; File: \"360se.exe\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"360se.exe\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00003376.00000001.308317.00F4B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"SetProcessMitigationPolicy\" (Indicator: \"SetProcessMitigationPolicy\"; File: \"360se.exe\")\n Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; File: \"360se.exe\")\n Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; File: \"360se.exe\")\n Found reference to API \"SetProcessMitigationPolicy\" (Indicator: \"SetProcessMitigationPolicy\"; Source: \"00000000-00001248.00000001.310177.010D8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00001248.00000001.310177.00400000.00000040.mdmp\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$73","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 360se.exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$74","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeChangeNotifyPrivilege\" (Indicator: \"SeChangeNotifyPrivilege\"; File: \"360se.exe\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"360se.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001248.00000001.310177.00400000.00000040.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003376.00000000.308171.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.00F4B000.00000002.mdmp, 00000000-00003376.00000001.308317.05E82000.00000004.mdmp, 00000000-00003376.00000001.308317.732F9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"sgfeedbackhelper.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$75","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$76","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$77","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"360se.exe\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$78","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"asvv.txt has high entropy\"\n \"shouhu.txt has high entropy\"","origin":"Binary File","mitre_attack_id":"T1027.013","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"bzzbynMg.lnk\" - Location: [%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\bzzbynMg.lnk]- [targetUID: 00000000-00003552]\n Dropped file: \"FaCveHBxNGHTyXP.lnkbOCafFc\" - Location: [%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\FaCveHBxNGHTyXP.lnkbOCafFc]- [targetUID: 00000000-00001248]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$79","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"360se.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"sgfeedbackhelperz.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"7z.dll\" was detected as \"Microsoft visual C++ 6.0 DLL\"\n \"7z.exe\" was detected as \"Microsoft visual C++ 5.0\"\n \"jzr.exe\" was detected as \"Microsoft visual C++ 8\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"backgroundTaskHost.exe\" (Indicator: \"backgroundtaskhost.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"360se.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"sgfeedbackhelper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"sgfeedbackhelper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"sgfeedbackhelperz.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"jzr.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; File: \"360se.exe\")\n Found string \"@explorer.exe\" (Indicator: \"explorer.exe\"; File: \"360se.exe\")\n Found string \"sogouexplorer.exe\" (Indicator: \"explorer.exe\"; File: \"360se.exe\")\n Found string \"2345explorer.exe\" (Indicator: \"explorer.exe\"; File: \"360se.exe\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-481","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Able to check if a debugger is running","description":"IsDebuggerPresent@KERNEL32.DLL at 00000000-00003552-49648-130-00947ED8\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00003552-49648-1000-00923B20\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00003552-49648-1472-00945122\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00007764-53975-44-010F121D\n OutputDebugStringW@KERNEL32.DLL at 00000000-00007764-53975-4035-00FDA9B0\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00007764-53975-5564-00FFC210\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00007764-53975-7811-010E6805\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00007764-53975-8190-010E6BB3\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00003376-60889-44-00F1121D\n OutputDebugStringW@KERNEL32.DLL at 00000000-00003376-60889-4035-00DFA9B0\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00003376-60889-5564-00E1C210\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00003376-60889-7811-00F06805\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00003376-60889-8189-00F06BB3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":3,"id":"stream-75","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"sgfeedbackhelper.exe\" at 00000000-00007764-00000C15-3775657412","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Tries to save executable or command in registry","description":"\"jzr.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\FACVEHBXN\\SHELL\\OPEN\\COMMAND\"; Key: \"(DEFAULT)\"; Value: \"%PROGRAMFILES%\\SogouInput\\E84C2983\\sgfeedbackhelper.exe\")","origin":"Registry Access","mitre_attack_id":"T1547","relevance":7,"id":"registry-113","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"360se.exe\" has section name .rsrc with entropy \"7.919913848515915\"\n \"sgfeedbackhelperz.exe\" has section name .rsrc with entropy \"7.750559431940128\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads VM-specific registry key","description":"$7a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-33","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/26 Antivirus vendors marked sample as malicious (15% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00000000-00003552-49648-759-00935B30\n FindResourceW@KERNEL32.DLL at 00000000-00003552-49648-1439-00935D30\n FindResourceW@KERNEL32.DLL at 00000000-00007764-53975-1212-01084780\n FindResourceW@KERNEL32.DLL at 00000000-00007764-53975-2115-010AFA10\n FindResourceW@KERNEL32.DLL at 00000000-00007764-53975-3481-01075F80\n FindResourceW@KERNEL32.DLL at 00000000-00007764-53975-5940-00FD1E1C\n FindResourceW@KERNEL32.DLL at 00000000-00003376-60889-1212-00EA4780\n FindResourceW@KERNEL32.DLL at 00000000-00003376-60889-2115-00ECFA10\n FindResourceW@KERNEL32.DLL at 00000000-00003376-60889-3481-00E95F80\n FindResourceW@KERNEL32.DLL at 00000000-00003376-60889-5940-00DF1E1C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$7b","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$7c","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$7d","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to call internet-related API for network communication","description":"\"sgfeedbackhelper.exe\" called \"gethostname\" with parameters (UID: 00000000-00007764)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-291","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%PROGRAMFILES%\\SogouInput\\E84C2983\\sgfeedbackhelper.exe\" connects to 154.91.64.65 on port 6666 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00001248.00000001.310177.00F40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"360se.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\1770570338\\TemporaryFile\\TemporaryFile\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"360se.exe\" opened \"C:\\360se.exe\" with delete access\n \"360se.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\1770570338\\TemporaryFile\\TemporaryFile\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"sgfeedbackhelper.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"sgfeedbackhelperz.exe\" claimed CRC 3351697 while the actual is CRC 11649107\n \"jzr.exe\" claimed CRC 76452 while the actual is CRC 418500","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$7e","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"jzr.exe\" claims program is from Sat Apr 24 16:10:49 1982","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"sgfeedbackhelper.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\SogouInput\\E84C2983\\sgfeedbackhelperz.exe\" MdGTPh\" - (UID: 00000000-00007764)\n \"sgfeedbackhelperz.exe\" called \"CreateProcessW\" with parameter \"%PROGRAMFILES%\\SogouInput\\E84C2983\\jzr.exe\" - (UID: 00000000-00003376)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Hooks process/system information retrieval APIs","description":"\"NtOpenProcess@NTDLL.DLL\" in \"sgfeedbackhelperz.exe\"\n \"NtQueryInformationProcess@NTDLL.DLL\" in \"sgfeedbackhelperz.exe\"\n \"NtOpenProcessToken@NTDLL.DLL\" in \"sgfeedbackhelperz.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-3","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"PE file contains executable resources","description":"360se.exe has PE file in resource with name: \"EXE\" and filetype:PE32 executable for MS Windows 5.01 (GUI)\n Intel i386\n 9 sections","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":10,"id":"static-97","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Reads Antivirus engine related registry keys","description":"\"sgfeedbackhelper.exe\" (Path: \"HKCU\\SOFTWARE\\TENCENT\\PLUGIN\\VAS\")","origin":"Registry Access","mitre_attack_id":"T1518.001","relevance":8,"id":"registry-32","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"malicious","category":"Environment Awareness","name":"Sets a global windows hook to intercept mouse events","description":"\"sgfeedbackhelper.exe\" set a windows hook with filter \"WH_MOUSE_LL\"","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-73","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET MALWARE Winos4.0 Framework CnC Login Message\" (SID: 2052875, Rev: 7, Severity: 1) categorized as \"Malware Command and Control Activity Detected\" (PUA/PUP/Adware)\n Detected alert \"ET MALWARE Winos4.0 Framework CnC Login Message CnC Server Response\" (SID: 2059975, Rev: 2, Severity: 1) categorized as \"Malware Command and Control Activity Detected\" (PUA/PUP/Adware)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"sgfeedbackhelper.exe\" called \"ShellExecuteW\" with parameter %PROGRAMFILES%\\SogouInput\\E84C2983\\sgfeedbackhelperz.exe (UID: 00000000-00007764)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$7f","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"malicious","category":"Network Related","name":"Sends network traffic on a port typically used by IRC","description":"\"IRC traffic to 154.91.64.65 on port 6666","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":6,"id":"network-13","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 154.91.64.65 on port 6666","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_BlackMoon\" matched process \"00000000-00007764\" as \"Detects executables using BlackMoon RunTime\" (Author: ditekSHen)\n YARA signature \"MALWARE_Win_BlackMoon\" matched process \"00000000-00007704\" as \"Detects executables using BlackMoon RunTime\" (Author: ditekSHen)\n YARA signature \"MALWARE_Win_BlackMoon\" matched process \"00000000-00001248\" as \"Detects executables using BlackMoon RunTime\" (Author: ditekSHen)","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match – BlackMoon","description":"YARA signature match – BlackMoon process \"00000000-00007764\"\n YARA signature match – BlackMoon process \"00000000-00007704\"\n YARA signature match – BlackMoon process \"00000000-00001248\"","origin":"YARA Signature","relevance":10,"id":"yara-631","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match – ValleyRAT","description":"YARA signature match – ValleyRat process \"00000000-00007764\"","origin":"YARA Signature","relevance":10,"id":"yara-632","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Tries to disable Windows defender Anti Spyware","description":"\"360se.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\"; Key: \"DISABLEANTISPYWARE\"; Value: \"0100000000\")\n \"sgfeedbackhelperz.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\"; Key: \"DISABLEANTISPYWARE\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":7,"id":"registry-76","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Hooks internet related APIs","description":"\"NtAlpcSendWaitReceivePort@NTDLL.DLL\" in \"sgfeedbackhelperz.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-5","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Known malware detected","description":"The sample is known malware – BlackMoon","origin":"Indicator Combinations","mitre_attack_id":"T1219","relevance":10,"id":"summary-5020","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"malicious","category":"System Security","name":"Modifies the UAC/LUA settings (Account Control)","description":"\"360se.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"ENABLELUA\"; Value: \"0000000000\")\n \"sgfeedbackhelperz.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"ENABLELUA\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":8,"id":"registry-10","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"360se.exe\" (UID: 00000000-00003552)\n Spawned process \"sgfeedbackhelper.exe\" (UID: 00000000-00007764)\n Spawned process \"sgfeedbackhelperz.exe\" with commandline \"MdGTPh\" (UID: 00000000-00003376)\n Spawned process \"jzr.exe\" (UID: 00000000-00007704)\n Spawned process \"jzr.exe\" (UID: 00000000-00001248)\n Spawned process \"jzr.exe\" (UID: 00000000-00007656)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Hooks internet related APIs"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"Spyware","details_count":4,"details":[{"detail":"Sets a global windows hook to intercept mouse events"},{"detail":"Hooks API calls"},{"detail":"Hooks process/system information retrieval APIs"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns a lot of processes"},{"detail":"Writes a file to the startup folder"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"Evasive","details_count":9,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"Reads Antivirus engine related registry keys"},{"detail":"Reads VM-specific registry key"},{"detail":"Tries to disable Windows defender Anti Spyware"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Attempts to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":21,"imported_dlls_count":104,"dropped_files_count":0,"extracted_files_count":14,"files_written_count":28,"files_deleted_count":0,"registry_keys_created_count":10,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":10,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["modular","criminal","rat","changemerat","trojan","windows-server-utility","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"698851c3da827283a805be02","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Application.Jaik","contacted_countries":["SGP"],"submit_name":"360se.exe","analysis_start_time":"2026-02-08T09:05:09+00:00","indicators_count":{"informative":258,"suspicious":88,"malicious":21},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"154.91.64.65","port":6666,"protocol":"TCP","country":"Singapore","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}],"processes":[{"pid":3552,"ppid":0,"name":"360se.exe","command_line":"","sha256":"718d8efde0ba4ba81ce3d1bf56a0e1a1acaace8f2dae94677473991b27276d91","normalized_path":"C:\\360se.exe","uid":"00000000-00003552","icon":"$80"},{"pid":7764,"ppid":3552,"name":"sgfeedbackhelper.exe","command_line":"","sha256":"b2230f1e1e4fe538eb3c513e6612d82453e708ac94373b155624a656620f1bbc","normalized_path":"%PROGRAMFILES%\\SogouInput\\E84C2983\\sgfeedbackhelper.exe","parent_uid":"00000000-00003552","uid":"00000000-00007764"},{"pid":3376,"ppid":7764,"name":"sgfeedbackhelperz.exe","command_line":"MdGTPh","sha256":"b2230f1e1e4fe538eb3c513e6612d82453e708ac94373b155624a656620f1bbc","normalized_path":"%PROGRAMFILES%\\SogouInput\\E84C2983\\sgfeedbackhelperz.exe","parent_uid":"00000000-00007764","uid":"00000000-00003376"},{"pid":7704,"ppid":3376,"name":"jzr.exe","command_line":"","sha256":"1030ce4102dac701fab043e40444e8f6c96c8c04b5bd512a59e1a4999d22b38c","normalized_path":"%PROGRAMFILES%\\SogouInput\\E84C2983\\jzr.exe","parent_uid":"00000000-00003376","uid":"00000000-00007704"},{"pid":1248,"ppid":3376,"name":"jzr.exe","command_line":"","sha256":"1030ce4102dac701fab043e40444e8f6c96c8c04b5bd512a59e1a4999d22b38c","normalized_path":"%PROGRAMFILES%\\SogouInput\\E84C2983\\jzr.exe","parent_uid":"00000000-00003376","uid":"00000000-00001248"},{"pid":7656,"ppid":3376,"name":"jzr.exe","command_line":"","sha256":"1030ce4102dac701fab043e40444e8f6c96c8c04b5bd512a59e1a4999d22b38c","normalized_path":"%PROGRAMFILES%\\SogouInput\\E84C2983\\jzr.exe","parent_uid":"00000000-00003376","uid":"00000000-00007656"}],"all_imported_dlls":["wow64.dll","clbcatq.dll","winmm.dll","Windows.StateRepositoryPS.dll","CoreMessaging.dll","avicap32.dll","sechost.dll","bcryptprimitives.dll","shlwapi.dll","kernel.appcore.dll","cryptsp.dll","ntshrui.dll","PlayToDevice.dll","DevDispItemProvider.dll","dlnashext.dll","OneCoreUAPCommonProxyStub.dll","IPHLPAPI.DLL","WindowsCodecs.dll","dxgi.dll","gdi32.dll","psapi.dll","setupapi.dll","msvcp_win.dll","SHCore.dll","VxSSL32.dll","devobj.dll","devenum.dll","sspicli.dll","ws2_32.dll","imm32.dll","aepic.dll","wpdshext.dll","netutils.dll","msimg32.dll","dnsapi.dll","advapi32.dll","shell32.dll","combase.dll","GdiPlus.dll","netapi32.dll","dinput8.dll","CoreUIComponents.dll","msasn1.dll","cfgmgr32.dll","oleaut32.dll","bcrypt.dll","uxtheme.dll","linkinfo.dll","FWPUCLNT.DLL","msdmo.dll","ntdll.dll","KernelBase.dll","win32u.dll","ucrtbase.dll","comctl32.dll","ntmarta.dll","samcli.dll","ole32.dll","version.dll","edputil.dll","rasadhlp.dll","msvfw32.dll","kernel32.dll","gdi32full.dll","windows.storage.dll","cscapi.dll","cryptdll.dll","ieframe.dll","iertutil.dll","propsys.dll","cldapi.dll","winmmbase.dll","ImageMagik.dll","winrnr.dll","wintrust.dll","wow64win.dll","wow64cpu.dll","cryptbase.dll","profapi.dll","oleacc.dll","msctf.dll","wkscli.dll","WinTypes.dll","powrprof.dll","srvcli.dll","dwmapi.dll","urlmon.dll","nlaapi.dll","crypt32.dll","user32.dll","apphelp.dll","msvcrt.dll","rpcrt4.dll","fltLib.dll","MMDevAPI.dll","HWSignature.dll","msIso.dll","advpack.dll","nsi.dll","imagehlp.dll","InputHost.dll","mswsock.dll","NapiNSP.dll","pnrpnsp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"7z.dll","sha256":"51075af59f6696d5dc5446ba39fabfd0022628cdcfa41c80e7cb66e3bf4ee55d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"7z.exe","sha256":"b1e06a424f2e7e3b9a5bf676665bd14bc39785fbc48cfdcc54ab63c574de0b01","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"HWSignature.dll","sha256":"39d0f9e828c2fd8ae1a6c5b88d1c95bc0f75b8f82a45ec6aa7ef60e809dd672b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"ImageMagik.dll","sha256":"fb9ab542ed543a4ecdabfe69db9d0d0a558e6ad5181ecfc22b19c13b2a8bc050","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"bzzbynMgNedca.exe","sha256":"e1d167abf51af8e2aba6eb57a2d0d6c0e0b17f5b5404b18c64b6009ab834806e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"sgfeedbackhelper.exe","sha256":"b2230f1e1e4fe538eb3c513e6612d82453e708ac94373b155624a656620f1bbc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"sgfeedbackhelperz.exe","sha256":"b2230f1e1e4fe538eb3c513e6612d82453e708ac94373b155624a656620f1bbc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"FaCveHBxNGHTyXP.lnkbOCafFc","sha256":"9d93ebadbdef5c722162093a65c01739903821c5ff4a9f368a7bdca4beef0c3f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"bzzbynMg.lnk","sha256":"cc34a0f79aeb74fe69224308919b733ba43927df4ff422997d4a47e19e10fe60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"1.zip","sha256":"0b134ec0b34e08e7a8b57beb9995d72b785a81d0a160782281179e25777e401d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"asvv.txt","sha256":"df5ac7bd3ee84c4e08ca48973e73f3a8c28a4ac7e3b4875a64e3158a712753aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"jzr.exe","sha256":"1030ce4102dac701fab043e40444e8f6c96c8c04b5bd512a59e1a4999d22b38c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"shouhu.txt","sha256":"42814c9857f5feb9bea67cc9ccfad1c0265514ae1eb7be3f50dc02f9e8ac0616","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"bzzbynMgNedca.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"path":"%PROGRAMFILES%\\SOGOUINPUT\\E84C2983\\ABC\\MICROSOFT\\WINDOWS\\START MENU\\PROGRAMS\\STARTUP","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"path":"%PROGRAMFILES%\\SOGOUINPUT\\E84C2983\\ABC\\MICROSOFT\\WINDOWS\\START MENU\\PROGRAMS","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"path":"%PROGRAMFILES%\\SOGOUINPUT\\E84C2983\\ABC\\MICROSOFT\\WINDOWS\\START MENU","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"path":"%PROGRAMFILES%\\SOGOUINPUT\\E84C2983\\ABC\\MICROSOFT\\WINDOWS","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"path":"%PROGRAMFILES%\\SOGOUINPUT\\E84C2983\\ABC\\MICROSOFT","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"path":"%PROGRAMFILES%\\SOGOUINPUT\\E84C2983\\ABC","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"path":"%PROGRAMFILES%\\SOGOUINPUT\\E84C2983","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"path":"%PROGRAMFILES%\\SogouInput\\E84C2983\\asvv.txt","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"path":"%PROGRAMFILES%\\SogouInput\\E84C2983\\shouhu.txt","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"path":"%PROGRAMFILES%\\SogouInput\\E84C2983\\1.zip","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"path":"%PROGRAMFILES%\\SogouInput\\E84C2983\\bzzbynMgNedca.exe","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"path":"%PROGRAMFILES%\\SogouInput\\E84C2983\\bzzbynMgNedca.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"path":"%PROGRAMFILES%\\SogouInput\\E84C2983\\jzr.exe","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"path":"%PROGRAMFILES%\\SogouInput\\E84C2983\\7z.exe","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"path":"%PROGRAMFILES%\\SogouInput\\E84C2983\\HWSignature.dll","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"path":"%PROGRAMFILES%\\SogouInput\\E84C2983\\ImageMagik.dll","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"path":"%PROGRAMFILES%\\SogouInput\\E84C2983\\sgfeedbackhelper.exe","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"path":"%PROGRAMFILES%\\SogouInput\\E84C2983\\sgfeedbackhelperz.exe","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"path":"%PROGRAMFILES%\\SogouInput\\E84C2983\\7z.dll","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\bzzbynMg.lnk","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"path":"%TEMP%\\LOG\\APP\\sgfeedbackhelper_7764.log","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"path":"%TEMP%\\LOG\\APP\\sgfeedbackhelperz_3376.log","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\FaCveHBxNGHTyXP.lnkbOCafFc","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"key":"HKCUHKCU\\SOFTWARE\\SOGOUINPUT.STORE.USER\\LOG\\","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"key":"HKCUHKCU\\SOFTWARE\\SOGOUINPUT.STORE.USER\\","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"key":"HKCUHKCU\\SOFTWARE\\SOGOUINPUT.STORE.USER\\LOG\\APP\\","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\.LNKBOCAFFC\\","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\FACVEHBXN\\SHELL\\OPEN\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\FACVEHBXN\\","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\FACVEHBXN\\SHELL\\","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\FACVEHBXN\\SHELL\\OPEN\\","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3552:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3552:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"Local\\SM0:3552:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"SM0:3552:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7764:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"Local\\SM0:7764:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"Local\\SM0:7764:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"2026. 2. 6","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"SM0:7764:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"sgime_user_lock","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\2026. 2. 6","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7764:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\sgime_user_lock","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7764:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"698851c3da827283a805be02"}]}]}},"report_ids":{"sandbox_job_ids":["698851c3da827283a805be02"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Agent.BO potentially unwanted application Sample 718d8efde0ba… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 718d8efde0ba…. Malware family: Agent.BO potentially unwanted application. Threat score 100/100. 6/27 AV engines flagged this file. 19 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/718d8efde0ba4ba81ce3d1bf56a0e1a1acaace8f2dae94677473991b27276d91"}],["$","meta","4",{"property":"og:title","content":"Malicious Agent.BO potentially unwanted application Sample 718d8efde0ba… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 718d8efde0ba…. Malware family: Agent.BO potentially unwanted application. Threat score 100/100. 6/27 AV engines flagged this file. 19 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/718d8efde0ba4ba81ce3d1bf56a0e1a1acaace8f2dae94677473991b27276d91"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Agent.BO potentially unwanted application Sample 718d8efde0ba… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 718d8efde0ba…. Malware family: Agent.BO potentially unwanted application. Threat score 100/100. 6/27 AV engines flagged this file. 19 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L81","11",{}]]