Analysis Report SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe

Overview

General Information

Sample Name: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe
Analysis ID: 385405
MD5: 29389832e538957dc769cf709f80144a
SHA1: 72f5ca06d840acbc9b49e4096e341c0dbaac891e
SHA256: d6d2e00343a3cad48cc2f4799ce87d27acc3ce154aed286c07f226de2e9c4035
Infos:

Most interesting Screenshot:

Detection

Score: 93
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Detected unpacking (creates a PE file in dynamic memory)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to detect sleep reduction / modifications
Contains functionality to infect the boot sector
Hides threads from debuggers
Installs new ROOT certificates
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file has a writeable .text section
Registers a new ROOT certificate
Tries to harvest and steal browser information (history, passwords, etc)
Tries to resolve many domain names, but no domain seems valid
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Checks for available system drives (often done to infect USB drives)
Checks if the current process is being debugged
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read device registry values (via SetupAPI)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
Installs a Chrome extension
May check if the current machine is a sandbox (GetTickCount - Sleep)
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains strange resources
Queries device information via Setup API
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Uses the system / local time for branch decision (may execute only at specific dates)
Yara signature match

Classification

AV Detection:

barindex
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Metadefender: Detection: 25% Perma Link
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe ReversingLabs: Detection: 64%
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Virustotal: Detection: 75% Perma Link
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Metadefender: Detection: 25% Perma Link
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe ReversingLabs: Detection: 64%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Joe Sandbox ML: detected

Cryptography:

barindex
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_1001F780 CryptStringToBinaryA,CryptStringToBinaryA,CertCreateCertificateContext,CertOpenStore,CertAddCertificateContextToStore,GetLastError,CertGetCertificateContextProperty,_memset,CertGetCertificateContextProperty,_memset,_memset,_sprintf,_sprintf,CertCloseStore,CertFreeCertificateContext, 0_2_1001F780
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_1001F780 CryptStringToBinaryA,CryptStringToBinaryA,CertCreateCertificateContext,CertOpenStore,CertAddCertificateContextToStore,GetLastError,CertGetCertificateContextProperty,_memset,CertGetCertificateContextProperty,_memset,_memset,_sprintf,_sprintf,CertCloseStore,CertFreeCertificateContext, 6_2_1001F780

Compliance:

barindex
Detected unpacking (creates a PE file in dynamic memory)
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Unpacked PE file: 6.2.26FF190E7AE0F7C7.exe.2660000.5.unpack
Uses 32bit PE files
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File opened: C:\Users\user\AppData\Local\Temp\download\msvcr71.dll Jump to behavior
Source: Binary string: d:\MiniTP\Src\MiniThunderPlatform\pdb\ProductForCommon\MiniThunderPlatform.pdb source: MiniThunderPlatform.exe.6.dr
Source: Binary string: c:\Projects\VS2005\EdgeCookiesView\Release\EdgeCookiesView.pdb source: 1618258522437.exe, 0000000B.00000000.357295730.000000000040F000.00000002.00020000.sdmp, 1618258522437.exe.6.dr
Source: Binary string: atl71.pdbT source: atl71.dll.6.dr
Source: Binary string: msvcr71.pdb\ source: msvcr71.dll.6.dr
Source: Binary string: atl71.pdb source: atl71.dll.6.dr
Source: Binary string: cmd_insert_server.icex-conference/x-cooltalk.movievideo/x-sgi-movievideo/x-msvideo.mxuvideo/vnd.mpegurl.qtvideo/quicktimevideo/mpeg.xmltext/xml.etxtext/x-setext.wmlstext/vnd.wap.wmlscript.wmltext/vnd.wap.wml.tsvtext/tab-separated-values.sgmtext/sgml.rtftext/rtf.rtxtext/richtext.txttext/plain.html.csstext/css.mshmodel/mesh.igsmodel/iges.xwdimage/x-xwindowdump.xpmimage/x-xpixmap.xbmimage/x-xbitmap.rgbimage/x-rgb.ppmimage/x-portable-pixmap.bgmimage/x-portable-graymap.pbmimage/x-portable-bitmap.pnmimage/x-portable-anymap.rasimage/x-cmu-raster.wbmpimage/vnd.wap.wbmp.djvimage/vnd.djvu.tiffimage/tiff.pngimage/png.jpgimage/jpeg.iefimage/ief.gifimage/gif.bmpimage/bmp.xyzchemical/x-xyz.pdbchemical/x-pdb.wavaudio/x-wavaudio/x-realaudio.arpmaudio/x-pn-realaudio-pluginaudio/x-pn-realaudio.m3uaudio/x-mpegurl.aifaudio/x-aiffaudio/mpeg.midiaudio/midiapplication/application/zip.xhtmlapplication/xhtml+xml.srcapplication/x-wais-source.ustarapplication/x-ustar.msapplication/x-troff-ms.meapplication/x-troff-me.manapplication/x-troff-man.texiapplication/x-texinfo.texapplication/x-tex.tclapplication/x-tclapplication/x-tar.sv4crcapplication/x-sv4crc.sv4cpioapplication/x-sv4cpio.sitapplication/x-stuffit.swfapplication/x-shockwave-flash.sharapplication/x-shar.shapplication/x-sh.latexapplication/x-latex.jsapplication/x-javascript.hdfapplication/x-hdf.gtarapplication/x-gtar.splapplication/x-futuresplash.dviapplication/x-dvi.cshapplication/x-csh.cpioapplication/x-cpio.pgnapplication/x-chess-pgn.vcdapplication/x-cdlink.bcpioapplication/x-bcpio.wmlscapplication/vnd.wap.wmlscriptc.wmlcapplication/vnd.wap.wmlc.wbxmlapplication/vnd.wap.wbxml.pptapplication/vnd.ms-powerpoint.xlsapplication/vnd.ms-excel.mifapplication/vnd.mif.smiapplication/smil.pdfapplication/pdf.odaapplication/oda.docapplication/msword.cptapplication/mac-compactpro.hqxapplication/mac-binhex40.ezapplication/andrew-inset source: download_user.dll.6.dr
Source: Binary string: d:\MiniDownloadLib\branches\bin\Product Release\download_user.pdb source: download_user.dll.6.dr
Source: Binary string: f:\sys\objfre_wxp_x86\i386\FsFilter32.pdbpJ source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp
Source: Binary string: d:\MiniTP\Src\MiniThunderPlatform\pdb\ProductForCommon\MiniThunderPlatform.pdbt source: MiniThunderPlatform.exe.6.dr
Source: Binary string: d:\MiniTP\Src\MiniThunderPlatform\pdb\ProductForCommon\xldl.pdb source: xldl.dll.6.dr
Source: Binary string: msvcp71.pdb source: msvcp71.dll.6.dr
Source: Binary string: e:\xl7\Product Release\dl_peer_id.pdb0 source: dl_peer_id.dll.6.dr
Source: Binary string: f:\sys\objfre_wxp_x86\i386\FsFilter32.pdb source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp
Source: Binary string: d:\workspace\xlframework\win32_component\ThunderFW\Release\ThunderFW.pdb source: ThunderFW.exe, 0000001B.00000002.420452829.0000000000B9C000.00000002.00020000.sdmp, ThunderFW.exe.6.dr
Source: Binary string: f:\sys\objfre_win7_amd64\amd64\FsFilter64.pdb source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp
Source: Binary string: e:\xl7\Product Release\dl_peer_id.pdb source: dl_peer_id.dll.6.dr
Source: Binary string: msvcr71.pdb source: msvcr71.dll.6.dr
Source: Binary string: d:\BranchAI\launcher\Release\fileLauncher.pdb source: MSI39DD.tmp.3.dr

Spreading:

barindex
Checks for available system drives (often done to infect USB drives)
Source: C:\Windows\SysWOW64\msiexec.exe File opened: z: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: x: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: v: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: t: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: r: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: p: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: n: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: l: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: j: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: h: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: f: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: b: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: y: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: w: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: u: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: s: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: q: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: o: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: m: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: k: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: i: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: g: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: e: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: c: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: a: Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_1001A1D0 FindFirstFileA,FindClose, 0_2_1001A1D0
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_1001A1D0 FindFirstFileA,FindClose, 6_2_1001A1D0
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Google\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\ Jump to behavior

Networking:

barindex
Tries to resolve many domain names, but no domain seems valid
Source: unknown DNS traffic detected: query: c431a802ff4a46b5.com replaycode: Name error (3)
Source: unknown DNS traffic detected: query: 55BE681FC6760236.com replaycode: Name error (3)
Source: unknown DNS traffic detected: query: 61d53b5a4bc1ab86.com replaycode: Name error (3)
Source: unknown DNS traffic detected: query: 9ed2feea30c3cc5d.com replaycode: Name error (3)
Source: unknown DNS traffic detected: query: BDC347C728B2D94D.com replaycode: Name error (3)
Source: unknown DNS traffic detected: query: 55be681fc6760236.com replaycode: Name error (3)
Source: unknown DNS traffic detected: query: bdc347c728b2d94d.com replaycode: Name error (3)
Source: unknown DNS traffic detected: query: C431A802FF4A46B5.com replaycode: Name error (3)
Source: unknown DNS traffic detected: query: 9ED2FEEA30C3CC5D.com replaycode: Name error (3)
Source: unknown DNS traffic detected: query: back19e64ea00d6ecfe1.io replaycode: Name error (3)
Source: unknown DNS traffic detected: query: 84B5A35D6E5335EF.com replaycode: Name error (3)
Source: unknown DNS traffic detected: query: 61D53B5A4BC1AB86.com replaycode: Name error (3)
Source: unknown DNS traffic detected: query: 84b5a35d6e5335ef.com replaycode: Name error (3)
Uses ping.exe to check the status of other devices and networks
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Source: unknown DNS traffic detected: query: c431a802ff4a46b5.com replaycode: Name error (3)
Source: unknown DNS traffic detected: query: 55BE681FC6760236.com replaycode: Name error (3)
Source: unknown DNS traffic detected: query: 61d53b5a4bc1ab86.com replaycode: Name error (3)
Source: unknown DNS traffic detected: query: 9ed2feea30c3cc5d.com replaycode: Name error (3)
Source: unknown DNS traffic detected: query: BDC347C728B2D94D.com replaycode: Name error (3)
Source: unknown DNS traffic detected: query: 55be681fc6760236.com replaycode: Name error (3)
Source: unknown DNS traffic detected: query: bdc347c728b2d94d.com replaycode: Name error (3)
Source: unknown DNS traffic detected: query: C431A802FF4A46B5.com replaycode: Name error (3)
Source: unknown DNS traffic detected: query: 9ED2FEEA30C3CC5D.com replaycode: Name error (3)
Source: unknown DNS traffic detected: query: back19e64ea00d6ecfe1.io replaycode: Name error (3)
Source: unknown DNS traffic detected: query: 84B5A35D6E5335EF.com replaycode: Name error (3)
Source: unknown DNS traffic detected: query: 61D53B5A4BC1AB86.com replaycode: Name error (3)
Source: unknown DNS traffic detected: query: 84b5a35d6e5335ef.com replaycode: Name error (3)
Source: 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: "name":"fb_dtsg","value":"name="fb_dtsg" value="Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: nonehttps://www.facebook.com/""2%d0https://graph.facebook.com/me/friends?access_token=%s&pretty=1&limit=1summarytotal_count{}summarytotal_count%dquery_friends.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: count = %d equals www.facebook.com (Facebook)
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe String found in binary or memory: &AboutZwww.VB-CABLE.com web site[News are on Facebook ! equals www.facebook.com (Facebook)
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: -3https://www.facebook.com/payments/settings/payment_methods/index.php?__a=1errorSummaryconfirmemail.phpcard_type_name-110query_payment2.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: ret = %s equals www.facebook.com (Facebook)
Source: 26FF190E7AE0F7C7.exe String found in binary or memory: _time":"13245952903455635","lastpingday":"13245947457776957","location":1,"manifest":{"app":{"launch":{"container":"tab","web_url":"http://www.youtube.com"},"web_content":{"enabled":true,"origin":"http://www.youtube.com"}},"current_locale":"en","default_locale equals www.youtube.com (Youtube)
Source: 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9sec-fetch-dest: documentsec-fetch-mode: navigatesec-fetch-site: same-originreferer: https://www.messenger.com/origin: https://www.messenger.comhttps://www.messenger.com/login/nonce/ookie: c_user=ookie: xs=ookie: ;%[^;]; https://m.facebook.com/settings/email/<span class="_52ji _8uk3">accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9sec-fetch-dest: documentsec-fetch-mode: navigatesec-fetch-site: noneupgrade-insecure-requests: 1</span></span>@&#064;@&#064;https://m.facebook.com/settings/sms/<strong><span dir="ltr">accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9sec-fetch-dest: documentsec-fetch-mode: navigatesec-fetch-site: noneupgrade-insecure-requests: 1</span></span>+ https://m.facebook.com/pages/creation_flow/?step=name&cat_ref_page_id=0&ref_type=launch_point"dtsg":{"token":"accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9sec-fetch-dest: documentsec-fetch-mode: navigatesec-fetch-site: noneupgrade-insecure-requests: 1"https://m.facebook.com/pages/create/edit_name/"draftID":Accept: */*Origin: https://m.facebook.comReferer: https://m.facebook.com/pages/creation_flow/?step=name&cat_ref_page_id=0&ref_type=launch_pointSec-Fetch-Dest: emptySec-Fetch-Mode: corsSec-Fetch-Site: same-originX-Requested-With: XMLHttpRequestX-Response-Format: JSONStreampage_name=&m_sess=&fb_dtsg=&jazoest=&__csr=&__req=3&__user=,"https://m.facebook.com/pages/creation_flow/?step=category&draft_id=&cat_ref_page_id=0&extra_data=%7B%22page_name%22%3A%22%22%7D"dtsg":{"token":"accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Referer: https://m.facebook.com/pages/creation_flow/?step=name&cat_ref_page_id=0&ref_type=launch_pointsec-fetch-dest: documentsec-fetch-mode: navigatesec-fetch-site: same-originSec-Fetch-User: ?1upgrade-insecure-requests: 1"https://m.facebook.com/pages/create/edit_category/"pageID":Referer: https://m.facebook.com/pages/creation_flow/?step=category&draft_id=&cat_ref_page_id=0&extra_data=%7B%22page_name%22%3A%22%22%7DAccept: */*Origin: https://m.facebook.comSec-Fetch-Dest: emptySec-Fetch-Mode: corsSec-Fetch-Site: same-originX-Response-Format: JSONStreamX-Requested-With: XMLHttpRequestpage_category=1300&draft_id=&m_sess=&fb_dtsg=&jazoest=&__csr=&__req=9&__user=}"+ .-_@@friends2page.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: pageid = %s equals www.facebook.com (Facebook)
Source: 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: bad allocationSOFTWARE\Mozilla\Mozilla FirefoxCurrentVersion\\MainInstall Directory%s\firefox.exe{}[]"1""2""3"123bad allocationc_user=xs=https://www.facebook.com/adsmanager/manage/adshttps://business.facebook.com/adsmanager/manage/adssettings/?act=&access_token:""access_token":""query_token_account_id.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: account_id = %s token =%s equals www.facebook.com (Facebook)
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: c_user=xs=https://www.facebook.com/ads/manager/account_settingsaccountID:"access_token:"Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: none""query_token_account_id_laomaozi.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: account_id = %s token =%s equals www.facebook.com (Facebook)
Source: 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: c_user=xs=https://www.facebook.com/adsmanager/manage/adshttps://business.facebook.com/adsmanager/manage/adswindow.location.replace("")/act___accessToken="Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: nonehttps:act=/\/"%[0-9]query_token_account_id2.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: account_id = %s token =%s equals www.facebook.com (Facebook)
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe String found in binary or memory: http://www.facebook.com/pages/VB-Audio-Software/396002733802606 equals www.facebook.com (Facebook)
Source: 26FF190E7AE0F7C7.exe String found in binary or memory: http://www.youtube.com equals www.youtube.com (Youtube)
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://www.facebook.com/"name="fb_dtsg" value=""logout_hash":"""logout_hash":"logoutToken:""logoutToken:"https://www.facebook.com/comet/try/source=SETTINGS_MENU&nctr[_mod]=pagelet_bluebar&__user=&__a=1&__csr=&__req=14&__beoa=0&__pc=PHASED%3ADEFAULT&dpr=1&__ccg=EXCELLENT&fb_dtsg=&jazoest=for (;;);{https://m.facebook.com/logout.php?h=%s&t=%sc_user=deleted"encrypted":"https://m.facebook.com/?_rdr""name="fb_dtsg" value="logout.phpm_sess=&fb_dtsg=&jazoest=&__csr=&__req=9&__a=&__user=https://m.facebook.com/bookmarks/flyout/body/?id=u_0_6\https://m.facebook.com/logout.php%sc_user=deletedhttps://m.facebook.com/?soft=bookmarks"logoutURL":"\"logout.phphttps://m.facebook.com&source=mtouch_logout_button&persist_locale=1&button_name=logout&button_location=settings%s equals www.facebook.com (Facebook)
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://www.facebook.com/ads/manager/account_settings equals www.facebook.com (Facebook)
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://www.facebook.com/adsmanager/manage/ads equals www.facebook.com (Facebook)
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://www.facebook.com/bookmarks/pages?ref_type=logout_gear equals www.facebook.com (Facebook)
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://www.facebook.com/comet/try/ equals www.facebook.com (Facebook)
Source: 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://www.facebook.com/connect/ping?client_id=124024574287414&domain=www.instagram.com&origin=1&redirect_uri=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2F1e2RywyANNe.js%3Fversion%3D42%23cb%3Df19f2d8a0dd2f24%26domain%3Dwww.instagram.com%26origin%3Dhttps%253A%252F%252Fwww.instagram.com%252Ff2dc055ae1b1274%26relation%3Dparent&response_type=token%2Csigned_request%2Ccode&sdk=joey&version=v2.2 equals www.facebook.com (Facebook)
Source: 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://www.facebook.com/connect/ping?client_id=124024574287414&domain=www.instagram.com&origin=1&redirect_uri=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2F1e2RywyANNe.js%3Fversion%3D42%23cb%3Df19f2d8a0dd2f24%26domain%3Dwww.instagram.com%26origin%3Dhttps%253A%252F%252Fwww.instagram.com%252Ff2dc055ae1b1274%26relation%3Dparent&response_type=token%2Csigned_request%2Ccode&sdk=joey&version=v2.2&access_token=&expires_in=Location: query_instagram_cookie.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: token = %s equals www.facebook.com (Facebook)
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://www.facebook.com/dialog/oauth?client_id=124024574287414&redirect_uri=https%3A%2F%2Fwww.instagram.com%2Faccounts%2Fsignup%2F&state=%7B%22fbLoginKey%22%3A%221l3a6gcoxzmx9bogry41n78unr193ooptzd1bmk8ggfxw5bdph1%22%2C%22fbLoginReturnURL%22%3A%22%2F%22%7D&scope=email&response_type=code%2Cgranted_scopes equals www.facebook.com (Facebook)
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://www.facebook.com/dialog/oauth?client_id=124024574287414&redirect_uri=https%3A%2F%2Fwww.instagram.com%2Faccounts%2Fsignup%2F&state=%7B%22fbLoginKey%22%3A%221l3a6gcoxzmx9bogry41n78unr193ooptzd1bmk8ggfxw5bdph1%22%2C%22fbLoginReturnURL%22%3A%22%2F%22%7D&scope=email&response_type=code%2Cgranted_scopesLocation: equals www.facebook.com (Facebook)
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://www.facebook.com/dialog/oauth?client_id=124024574287414&redirect_uri=https%3A%2F%2Fwww.instagram.com%2Faccounts%2Fsignup%2F&state=%7B%22fbLoginKey%22%3A%221l3a6gcoxzmx9bogry41n78unr193ooptzd1bmk8ggfxw5bdph1%22%2C%22fbLoginReturnURL%22%3A%22%2F%22%7D&scope=email&response_type=code%2Cgranted_scopesocation: equals www.facebook.com (Facebook)
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://www.facebook.com/login/async_sso/messenger_dot_com/?__a=1 equals www.facebook.com (Facebook)
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://www.facebook.com/login/async_sso/messenger_dot_com/?__a=1x-auth-result: query_mess_cookie.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: x_auth_result = %s equals www.facebook.com (Facebook)
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://www.facebook.com/payments/settings/payment_methods/index.php?__a=1 equals www.facebook.com (Facebook)
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://www.facebook.com/x/oauth/status?client_id=124024574287414&input_token&origin=1&redirect_uri= equals www.facebook.com (Facebook)
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://www.facebook.com/x/oauth/status?client_id=124024574287414&input_token&origin=1&redirect_uri=origin: https://www.instagram.comsec-fetch-mode: corsreferer: https://www.instagram.com/sec-fetch-site: cross-sitefb-ar: equals www.facebook.com (Facebook)
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://www.instagram.com/accounts/login/ajax/facebook/ equals www.facebook.com (Facebook)
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe String found in binary or memory: qSOFTWARE\Microsoft\Windows\CurrentVersion\MMDevices\Audio{83da6326-97a6-4088-9453-a1923f573b29},3{1da5d803-d492-4edd-8c23-e0c0ffee7f0e},3{1da5d803-d492-4edd-8c23-e0c0ffee7f0e},6{e4870e26-3cc5-4cd2-ba46-ca0a9a70ed04},0{f19f064d-082c-4e27-bc73-6882a1bb8e4c},0FRCFLCBRBLLFFCFRFLIsWow64ProcessKernel32.dllArial-inf db%0.1f db%0.1f %%%i bits%i Hz%i-Input Levelsb1024:b512:b256:b128:Init:Pull loss:Push loss:Buffers:StatisticsOutputres:sr:ch:Input%i smpMax Latency:Internal SR:%i.%i.%i.%iDriver Version:VB-Audio Virtual CableDriver Name:SYSTEM\CurrentControlSet\Services\VB-CableSOFTWARE\VB-Audio\CableVBAudioCableWDM_SRVBAudioCableWDMhttp://www.vb-audio.comhttp://www.facebook.com/pages/VB-Audio-Software/396002733802606The change will take effect on next launch... equals www.facebook.com (Facebook)
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: x-csrftoken: xhttps://www.instagram.com/accounts/login/ajax/facebook/"userId": "sessionid="";sessionid=;query_instagram_cookie.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: sessionid = %s equals www.facebook.com (Facebook)
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: x-csrftoken: xhttps://www.instagram.com/accounts/login/ajax/facebook/"userId": "sessionid="";sessionid=;query_instagram_cookie_20191224.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: sessionid = %s equals www.facebook.com (Facebook)
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: x-csrftoken: xhttps://www.instagram.com/accounts/login/ajax/facebook/"userId": "sessionid="";sessionid=;query_instagram_cookie_20200229.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: sessionid = %s equals www.facebook.com (Facebook)
Source: unknown DNS traffic detected: queries for: 9ed2feea30c3cc5d.com
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.418434135.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://55BE681FC6760236.com/
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.418434135.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://55BE681FC6760236.com/RI
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.435213084.0000000002E68000.00000004.00000001.sdmp String found in binary or memory: http://55BE681FC6760236.com/info_old/ddd
Source: 26FF190E7AE0F7C7.exe, 00000007.00000002.368367614.00000000006C1000.00000004.00000020.sdmp String found in binary or memory: http://55BE681FC6760236.com/info_old/w/wk
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000002.354220251.000000000074A000.00000004.00000020.sdmp String found in binary or memory: http://55BE681FC6760236.com/info_old/w:
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000003.340514679.000000000077D000.00000004.00000001.sdmp String found in binary or memory: http://55be681fc6760236.com/
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.418434135.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://61D53B5A4BC1AB86.com/
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.418434135.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://61D53B5A4BC1AB86.com/AR
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.435775291.0000000002E68000.00000004.00000001.sdmp String found in binary or memory: http://61D53B5A4BC1AB86.com/info_old/ddd
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.435775291.0000000002E68000.00000004.00000001.sdmp String found in binary or memory: http://61D53B5A4BC1AB86.com/info_old/dddmX
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000002.354220251.000000000074A000.00000004.00000020.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.368367614.00000000006C1000.00000004.00000020.sdmp String found in binary or memory: http://61D53B5A4BC1AB86.com/info_old/w
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000002.354369289.000000000077D000.00000004.00000020.sdmp String found in binary or memory: http://61D53B5A4BC1AB86.com/o/
Source: 26FF190E7AE0F7C7.exe, 00000007.00000002.368375423.00000000006C8000.00000004.00000020.sdmp String found in binary or memory: http://61d1a802ff4a46b5.com/
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.418434135.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://84B5A35D6E5335EF.com/
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.418434135.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://84B5A35D6E5335EF.com/2
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.418434135.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://84B5A35D6E5335EF.com/_1D
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.433202764.0000000002E68000.00000004.00000001.sdmp String found in binary or memory: http://84B5A35D6E5335EF.com/info_old/ddd
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000002.354220251.000000000074A000.00000004.00000020.sdmp String found in binary or memory: http://84B5A35D6E5335EF.com/info_old/w
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000002.354369289.000000000077D000.00000004.00000020.sdmp String found in binary or memory: http://84B5A35D6E5335EF.com/vx6
Source: 26FF190E7AE0F7C7.exe, 00000007.00000002.368404745.00000000006E2000.00000004.00000020.sdmp String found in binary or memory: http://84b347c728b2d94d.com/
Source: 26FF190E7AE0F7C7.exe, 00000007.00000002.368384019.00000000006D1000.00000004.00000020.sdmp String found in binary or memory: http://84b5a35d6e5335ef.com/info_old/w
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000003.340480997.0000000000790000.00000004.00000001.sdmp String found in binary or memory: http://84b5a35d6e5335ef.com/info_old/wc
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.418434135.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://9ED2FEEA30C3CC5D.com/
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.418434135.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://9ED2FEEA30C3CC5D.com//U
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.431133751.0000000002E68000.00000004.00000001.sdmp String found in binary or memory: http://9ED2FEEA30C3CC5D.com/info_old/ddd
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.431133751.0000000002E68000.00000004.00000001.sdmp String found in binary or memory: http://9ED2FEEA30C3CC5D.com/info_old/dddio
Source: 26FF190E7AE0F7C7.exe, 00000007.00000002.368367614.00000000006C1000.00000004.00000020.sdmp String found in binary or memory: http://9ED2FEEA30C3CC5D.com/info_old/w)$
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000002.354369289.000000000077D000.00000004.00000020.sdmp String found in binary or memory: http://9ED2FEEA30C3CC5D.com/o/
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000002.354220251.000000000074A000.00000004.00000020.sdmp String found in binary or memory: http://9ed2feea30c3cc5d.com//fine/send
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000003.340514679.000000000077D000.00000004.00000001.sdmp String found in binary or memory: http://9ed2feea30c3cc5d.com/info_old/w
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000003.340514679.000000000077D000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000006.00000003.418434135.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://BDC347C728B2D94D.com/
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000003.340514679.000000000077D000.00000004.00000001.sdmp String found in binary or memory: http://BDC347C728B2D94D.com//n7
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.418434135.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://BDC347C728B2D94D.com/g
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.435775291.0000000002E68000.00000004.00000001.sdmp String found in binary or memory: http://BDC347C728B2D94D.com/info_old/ddd
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000002.354220251.000000000074A000.00000004.00000020.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.368367614.00000000006C1000.00000004.00000020.sdmp String found in binary or memory: http://BDC347C728B2D94D.com/info_old/w
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.418434135.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://BDC347C728B2D94D.com/l
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000002.354369289.000000000077D000.00000004.00000020.sdmp String found in binary or memory: http://BDC347C728B2D94D.com/ll
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.418434135.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://BDC347C728B2D94D.com/o/
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000002.354369289.000000000077D000.00000004.00000020.sdmp String found in binary or memory: http://BDC347C728B2D94D.com/o/S6
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.418434135.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://C431A802FF4A46B5.com/
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.418434135.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://C431A802FF4A46B5.com/in
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.432211570.0000000002E68000.00000004.00000001.sdmp String found in binary or memory: http://C431A802FF4A46B5.com/info_old/ddd
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000002.354220251.000000000074A000.00000004.00000020.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.368367614.00000000006C1000.00000004.00000020.sdmp String found in binary or memory: http://C431A802FF4A46B5.com/info_old/w
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000003.347655574.0000000000790000.00000004.00000001.sdmp String found in binary or memory: http://C431A802FF4A46B5.com/info_old/wx
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000003.340514679.000000000077D000.00000004.00000001.sdmp String found in binary or memory: http://C431A802FF4A46B5.com/ll
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.418434135.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://C431A802FF4A46B5.com/o/
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000002.354369289.000000000077D000.00000004.00000020.sdmp, SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000003.340514679.000000000077D000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000006.00000003.418434135.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://back19e64ea00d6ecfe1.io/
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.418434135.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://back19e64ea00d6ecfe1.io/N
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.418434135.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://back19e64ea00d6ecfe1.io/b
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000002.354369289.000000000077D000.00000004.00000020.sdmp String found in binary or memory: http://back19e64ea00d6ecfe1.io/e7
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.435775291.0000000002E68000.00000004.00000001.sdmp String found in binary or memory: http://back19e64ea00d6ecfe1.io/info_old/ddd
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000002.354220251.000000000074A000.00000004.00000020.sdmp, 26FF190E7AE0F7C7.exe, 00000006.00000003.418434135.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://back19e64ea00d6ecfe1.io/info_old/w
Source: 26FF190E7AE0F7C7.exe, 00000007.00000002.368367614.00000000006C1000.00000004.00000020.sdmp String found in binary or memory: http://back19e64ea00d6ecfe1.io/info_old/w$%
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000003.340514679.000000000077D000.00000004.00000001.sdmp String found in binary or memory: http://back19e64ea00d6ecfe1.io/info_old/w.
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.418434135.0000000002E66000.00000004.00000001.sdmp String found in binary or memory: http://back19e64ea00d6ecfe1.io/s
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000003.340514679.000000000077D000.00000004.00000001.sdmp String found in binary or memory: http://bdc347c728b2d94d.com/
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000002.354369289.000000000077D000.00000004.00000020.sdmp String found in binary or memory: http://bdc347c728b2d94d.com/X
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000003.340514679.000000000077D000.00000004.00000001.sdmp String found in binary or memory: http://bdc347c728b2d94d.com/u
Source: 26FF190E7AE0F7C7.exe, 00000007.00000002.368428478.00000000006F5000.00000004.00000020.sdmp String found in binary or memory: http://bdck19e64ea00d6ecfe1.io/
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000003.340381653.00000000007B4000.00000004.00000001.sdmp String found in binary or memory: http://bdcsvchost.exe
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000003.340514679.000000000077D000.00000004.00000001.sdmp String found in binary or memory: http://c431a802ff4a46b5.com/info_old/w
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000003.340514679.000000000077D000.00000004.00000001.sdmp String found in binary or memory: http://c431a802ff4a46b5.com/info_old/w#
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000002.354369289.000000000077D000.00000004.00000020.sdmp String found in binary or memory: http://c431a802ff4a46b5.com/o/
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000002.354348509.0000000000772000.00000004.00000020.sdmp String found in binary or memory: http://c43347c728b2d94d.com/
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceCodeSigningCA-1.crt0
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2ExtendedValidationServerCA.crt0
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceCodeSigningCA.crt0
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt0
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt0
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSecureSiteECCCA-1.crt0
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000002.354726295.0000000002135000.00000004.00000040.sdmp String found in binary or memory: http://charlesproxy.com/ssl
Source: 26FF190E7AE0F7C7.exe, 26FF190E7AE0F7C7.exe, 00000007.00000003.364737158.0000000003F1C000.00000004.00000001.sdmp String found in binary or memory: http://clients2.google.com/service/update2/crx
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364818535.0000000003F25000.00000004.00000001.sdmp String found in binary or memory: http://clients2.google.com/service/update2/crxE
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://cookies.onetrust.mgr.consensu.org/?name=euconsent&value=&expire=0&isFirstRequest=true
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://cookies.onetrust.mgr.consensu.org/onetrust-logo.svg
Source: 1618258522437.exe.6.dr String found in binary or memory: http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
Source: 1618258522437.exe.6.dr String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: 1618258522437.exe.6.dr String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://crl.pki.goog/GTS1O1core.crl0
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://crl.pki.goog/GTSGIAG3.crl0
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://crl.pki.goog/gsr2/gsr2.crl0?
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0O
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://crl3.digicert.com/DigiCertSecureSiteECCCA-1.crl0
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0=
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: http://crl3.digicert.com/ha-cs-2011a.crl0.
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://crl3.digicert.com/sha2-ev-server-g2.crl04
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: http://crl3.digicert.com/sha2-ha-cs-g1.crl00
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://crl3.digicert.com/sha2-ha-server-g6.crl04
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://crl3.digicert.com/ssca-sha2-g6.crl0/
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl0=
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://crl4.digicert.com/DigiCertSecureSiteECCCA-1.crl0L
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: http://crl4.digicert.com/ha-cs-2011a.crl0L
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://crl4.digicert.com/sha2-ev-server-g2.crl0K
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: http://crl4.digicert.com/sha2-ha-cs-g1.crl0L
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://crl4.digicert.com/sha2-ha-server-g6.crl0L
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://crl4.digicert.com/ssca-sha2-g6.crl0L
Source: 26FF190E7AE0F7C7.exe String found in binary or memory: http://docs.google.com/
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.435810988.0000000003EE3000.00000004.00000001.sdmp String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.435810988.0000000003EE3000.00000004.00000001.sdmp String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exeM~1U
Source: 26FF190E7AE0F7C7.exe String found in binary or memory: http://drive.google.com/
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://google.com/chrome
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6IiIsIml1ZSI6Imh0dHA6Ly9pbWFnZXMyLnplbWFudGEuY29tL
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6IjIwZTg0ZTY4NTUwZTU4OGJhMzFmNmI5YjE4N2E4NDAyZWVmO
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6IjJhM2VjZmJmYzJjMzAzZjVjMGM1MjhiNDZjYWEyNDY0MGI2M
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6Ijk4OGQ1ZDgwMWE2ODQ2NDNkM2ZkMmYyMGEwOTgwMWQ3MDE2Z
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6ImQ1Y2M3ZjUxNTk0ZjI1ZWI5NjQxNjllMjcxMDliYzA5MWY4N
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA61Ofl?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA7XCQ3?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AABzUSt?h=368&w=622&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADsAOZ?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADsZuW?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADuTp7?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADuZko?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADv4Ge?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADv842?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADv9IZ?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADvbPR?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADvbce?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADvhNP?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADvhax?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADvqEs?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADvuGs?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADvzqT?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAyuliQ?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAzjSw3?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB16g6qc?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17milU?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB18T33l?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xDME?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xGDT?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xMWp?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xaUu?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xssM?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xzm6?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yF6n?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yFoT?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yG8H?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yKf2?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19ylKx?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yuvA?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yxVU?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1kc8s?m=6&o=true&u=true&n=true&w=30&h=30
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB6Ma4a?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB7hjL?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBMQmHU?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBMVUFn?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBO5Geh?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBPfCZL?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBRUB0d?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBS0Ogx?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBVuaWG?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBVuddh?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBWoHwx?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBX2afX?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBih5H?m=6&o=true&u=true&n=true&w=30&h=30
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBkwUr?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBnYSFZ?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BByBEMv?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.371452614.0000000003EF2000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.
Source: 1618258522437.exe.6.dr String found in binary or memory: http://ocsp.comodoca.com0
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://ocsp.digicert.com0
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://ocsp.digicert.com0:
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://ocsp.digicert.com0B
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://ocsp.digicert.com0E
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://ocsp.digicert.com0F
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.digicert.com0I
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://ocsp.digicert.com0K
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://ocsp.digicert.com0M
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.digicert.com0P
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp, ecv5AA4.tmp.11.dr String found in binary or memory: http://ocsp.digicert.com0R
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://ocsp.msocsp.com0
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://ocsp.pki.goog/GTSGIAG30
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://ocsp.pki.goog/gsr202
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://ocsp.pki.goog/gts1o1core0
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe String found in binary or memory: http://ocsp.thawte.com0
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0#
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0M
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://pki.goog/gsr2/GTSGIAG3.crt0)
Source: download_user.dll.6.dr String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: download_user.dll.6.dr String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe String found in binary or memory: http://sf.symcb.com/sf.crl0f
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe String found in binary or memory: http://sf.symcb.com/sf.crt0
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe String found in binary or memory: http://sf.symcd.com0&
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/2366737e/webcore/externalscripts/oneTrust/ski
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/5445db85/webcore/externalscripts/oneTrust/de-
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/975a7d20/webcore/externalscripts/jquery/jquer
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/css/3bf20fde-50425371/directi
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/js/3bf20fde-2923b6c2/directio
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/js/3bf20fde-b532f4eb/directio
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/js/f60532dd-2923b6c2/directio
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/js/f60532dd-f8dd99d9/directio
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/11/755f86.png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/64/a8a064.gif
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/81/58b810.gif
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/86/2042ed.woff
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/9b/e151e5.gif
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/ea/4996b9.woff
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA61Ofl.img?h=16&w=16&m
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA7XCQ3.img?h=16&w=16&m
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AABzUSt.img?h=368&w=622
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADsAOZ.img?h=333&w=311
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADsZuW.img?h=166&w=310
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADuTp7.img?h=333&w=311
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADuZko.img?h=75&w=100&
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADv4Ge.img?h=75&w=100&
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADv842.img?h=250&w=300
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADv9IZ.img?h=75&w=100&
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADvbPR.img?h=250&w=300
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADvbce.img?h=166&w=310
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADvhNP.img?h=166&w=310
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADvhax.img?h=166&w=310
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADvqEs.img?h=166&w=310
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADvuGs.img?h=333&w=311
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADvzqT.img?h=166&w=310
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAyuliQ.img?h=16&w=16&m
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAzjSw3.img?h=16&w=16&m
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB16g6qc.img?h=27&w=27&
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17milU.img?h=16&w=16&
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB18T33l.img?h=333&w=31
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xDME.img?h=75&w=100
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xGDT.img?h=166&w=31
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xMWp.img?h=75&w=100
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xaUu.img?h=166&w=31
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xssM.img?h=75&w=100
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xzm6.img?h=250&w=30
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yF6n.img?h=333&w=31
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yFoT.img?h=75&w=100
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yG8H.img?h=166&w=31
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yKf2.img?h=75&w=100
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19ylKx.img?h=75&w=100
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yuvA.img?h=250&w=30
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yxVU.img?h=166&w=31
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1kc8s.img?m=6&o=true&
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB6Ma4a.img?h=16&w=16&m
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB7hjL.img?h=16&w=16&m=
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBMQmHU.img?h=16&w=16&m
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBMVUFn.img?h=16&w=16&m
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBO5Geh.img?h=16&w=16&m
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBPfCZL.img?h=27&w=27&m
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBRUB0d.img?h=16&w=16&m
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBS0Ogx.img?h=75&w=100&
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBVuaWG.img?h=16&w=16&m
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBVuddh.img?h=16&w=16&m
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBWoHwx.img?h=27&w=27&m
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBX2afX.img?h=27&w=27&m
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBih5H.img?m=6&o=true&u
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBkwUr.img?h=16&w=16&m=
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBnYSFZ.img?h=16&w=16&m
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BByBEMv.img?h=16&w=16&m
Source: MiniThunderPlatform.exe.6.dr String found in binary or memory: http://store.paycenter.uc.cn
Source: MiniThunderPlatform.exe.6.dr String found in binary or memory: http://store.paycenter.uc.cnmail-attachment.googleusercontent.com
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: 26FF190E7AE0F7C7.exe, 00000007.00000002.369987694.0000000003170000.00000004.00000001.sdmp String found in binary or memory: http://www.interestvideo.com/video1.php
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://www.msn.com
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://www.msn.com/
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://www.msn.com/?ocid=iehp
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://www.msn.com/de-ch/?ocid=iehp
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://www.msn.com/de-ch/entertainment/_h/c920645c/webcore/externalscripts/oneTrustV2/consent/55a804
Source: ecv5AA4.tmp.11.dr String found in binary or memory: http://www.msn.com/de-ch/entertainment/_h/c920645c/webcore/externalscripts/oneTrustV2/scripttemplate
Source: 1618258522437.exe, 0000000B.00000002.369295802.0000000000198000.00000004.00000010.sdmp String found in binary or memory: http://www.nirsoft.net
Source: 1618258522437.exe, 1618258522437.exe.6.dr String found in binary or memory: http://www.nirsoft.net/
Source: download_user.dll.6.dr String found in binary or memory: http://www.openssl.org/support/faq.html
Source: download_user.dll.6.dr String found in binary or memory: http://www.openssl.org/support/faq.html....................
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe String found in binary or memory: http://www.vb-audio.com
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe String found in binary or memory: http://www.vb-cable.com
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe String found in binary or memory: http://www.vb-cable.comVBCABLE
Source: download_user.dll.6.dr String found in binary or memory: http://www.xunlei.com/
Source: download_user.dll.6.dr String found in binary or memory: http://www.xunlei.com/GET
Source: 26FF190E7AE0F7C7.exe String found in binary or memory: http://www.youtube.com
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=9774759596232;g
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=chrom322;cat=chrom01g;ord=30055406629
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=7859736
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.435775291.0000000002E68000.00000004.00000001.sdmp String found in binary or memory: https://670D67B00237B933.xyz/
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.435775291.0000000002E68000.00000004.00000001.sdmp String found in binary or memory: https://670D67B00237B933.xyz//Z
Source: Web Data1618258532140.6.dr String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364667666.0000000003F55000.00000004.00000001.sdmp String found in binary or memory: https://accounts.google.com
Source: 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://ads.google.com/nav/_/rpc/GaiaInfoService/Get?authuser=0&rpcTrackingId=GaiaInfoService.Get%3A
Source: 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://ads.google.com/nav/_/rpc/UserByGaiaService/Get?authuser=0&rpcTrackingId=UserByGaiaService.Ge
Source: 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://ads.google.com/nav/_/rpc/UserCustomerAccessService/List?authuser=0&rpcTrackingId=UserCustome
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://ads.google.com/nav/selectaccount
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://ads.google.com/nav/selectaccountocation:
Source: 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://ads.google.comsec-fetch-dest:
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://adservice.google.co.uk/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=3005540662929;gt
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://adservice.google.com/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=3005540662929;gtm=
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://amp.azure.net/libs/amp/1.8.0/azuremediaplayer.min.js
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://api.twitter.com/1.1/statuses/update.json
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://api.twitter.com/1.1/statuses/update.jsoninclude_profile_interstitial_type=1&include_blocking
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364667666.0000000003F55000.00000004.00000001.sdmp String found in binary or memory: https://apis.google.com
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://arc.msn.com/v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=314559&adm=
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC54c8a2b02c3446f48a60b41e8a5ff47
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC5bdddb231cf54f958a5b6e76e9d8eee
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC828bc1cde9f04b788c98b5423157734
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC9b2d2bc73c8a4a1d8dd5c3d69b6634a
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCc13122162a9a46c3b4cbf05ffccde0f
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCc71c68d7b8f049b6a6f3b669bd5d00c
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCee0d4d5fd4424c8390d703b105f82c3
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCfd484f9188564713bbc5d13d862ebbf
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://assets.adobedtm.com/launch-EN7b3d710ac67a4a1195648458258f97dd.min.js
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Source: Web Data1618258532140.6.dr String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000002.354726295.0000000002135000.00000004.00000040.sdmp String found in binary or memory: https://charlesproxy.com/ssl1
Source: 26FF190E7AE0F7C7.exe, 26FF190E7AE0F7C7.exe, 00000007.00000003.364737158.0000000003F1C000.00000004.00000001.sdmp String found in binary or memory: https://chrome.google.com/webstore
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364093257.0000000003FA5000.00000004.00000001.sdmp, background.js.7.dr String found in binary or memory: https://chrome.google.com/webstore/category/extension
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364667666.0000000003F55000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000003.363870256.0000000003F1B000.00000004.00000001.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364704865.0000000003F3A000.00000004.00000001.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crxT
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364818535.0000000003F25000.00000004.00000001.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crxi
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364737158.0000000003F1C000.00000004.00000001.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crxj
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364841271.0000000002F26000.00000004.00000001.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crxset_
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364667666.0000000003F55000.00000004.00000001.sdmp String found in binary or memory: https://content.googleapis.com
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://contextual.media.net/
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://contextual.media.net/48/nrrV18753.js
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://contextual.media.net/803288796/fcmain.js?&gdpr=0&cid=8CU157172&cpcd=pC3JHgSCqY8UHihgrvGr0A%3
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://contextual.media.net/__media__/js/util/nrrV9140.js
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439393307.0000000003140000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.369987694.0000000003170000.00000004.00000001.sdmp String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://cvision.media.net/new/286x175/2/189/134/171/257b11a9-f3a3-4bb3-9298-c791f456f3d0.jpg?v=9
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://cvision.media.net/new/286x175/3/248/152/169/520bb037-5f8d-42d6-934b-d6ec4a6832e8.jpg?v=9
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://cvision.media.net/new/300x300/2/189/9/46/83cfba42-7d45-4670-a4a7-a3211ca07534.jpg?v=9
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://cvision.media.net/new/300x300/3/167/174/27/39ab3103-8560-4a55-bfc4-401f897cf6f2.jpg?v=9
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://cvision.media.net/new/300x300/3/237/70/222/47ef75a1-aa03-4dce-a349-91d6a5ed47bb.jpg?v=9
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe String found in binary or memory: https://d.symcb.com/cps0%
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe String found in binary or memory: https://d.symcb.com/rpa0
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7B9B620FEE
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364768213.0000000003F2A000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000003.364737158.0000000003F1C000.00000004.00000001.sdmp String found in binary or memory: https://docs.google.com/
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364768213.0000000003F2A000.00000004.00000001.sdmp String found in binary or memory: https://drive.google.com/
Source: 26FF190E7AE0F7C7.exe String found in binary or memory: https://drive.google.com/?usp=chrome_app
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364737158.0000000003F1C000.00000004.00000001.sdmp String found in binary or memory: https://drive.google.com/?usp=chrome_app1iB
Source: 26FF190E7AE0F7C7.exe String found in binary or memory: https://drive.google.com/drive/settings
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364737158.0000000003F1C000.00000004.00000001.sdmp String found in binary or memory: https://drive.google.com/drive/settingsr
Source: Web Data1618258532140.6.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data1618258532140.6.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data1618258532140.6.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://exchangework%04d%02d%02d.xyz/http://hellojackma%04d%02d.com/hellojackma%04d%02d1.com/helloja
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364667666.0000000003F55000.00000004.00000001.sdmp String found in binary or memory: https://feedback.googleusercontent.com
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://fonts.googleapis.com/css?family=Google
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364667666.0000000003F55000.00000004.00000001.sdmp String found in binary or memory: https://fonts.googleapis.com;
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v16/4UaGrENHsxJlGDuGo1OIlI3K.woff
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v16/4UabrENHsxJlGDuGo1OIlLU94bt3.woff
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9vAA.woff
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Me5g.woff
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364667666.0000000003F55000.00000004.00000001.sdmp String found in binary or memory: https://fonts.gstatic.com;
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.363870256.0000000003F1B000.00000004.00000001.sdmp String found in binary or memory: https://hangouts.google.com/
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4DnuZ
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4Dnv6
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4Dnwt
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4DsDH
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FBmQ
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FBmV
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FBmZ
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FGwC
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4n1yl
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4n4cm
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4ncJ7
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4ncJa
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4nqTh
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4sQww?ver=37ff
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tD2S
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tG3O
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tIoW
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tIoY
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tKUA
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tMOD
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tMOM
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tQVa
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4u1kF
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4ubMD
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4wqj5
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4zuiC
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RWeTGO?ver=8c74&q=90&m=
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ce_sharpen%2Ch_311%2Cw_207%2Cc_fill%
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://logincdn.msauth.net/16.000.28230.00/MeControl.js
Source: 26FF190E7AE0F7C7.exe String found in binary or memory: https://mail.google.com/mail
Source: 26FF190E7AE0F7C7.exe String found in binary or memory: https://mail.google.com/mail/#settings
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.360425883.0000000003F11000.00000004.00000001.sdmp String found in binary or memory: https://mail.google.com/mail/#settingsFTGxQ
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364704865.0000000003F3A000.00000004.00000001.sdmp String found in binary or memory: https://mail.google.com/mailk
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://mem.gfx.ms/me/MeControl/10.19168.0/en-US/meBoot.min.js
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://mem.gfx.ms/me/MeControl/10.19168.0/en-US/meCore.min.js
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://mem.gfx.ms/meversion?partner=RetailStore2&market=en-us&uhf=1
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://mwf-service.akamaized.net/mwf/css/bundle/1.57.0/west-european/default/mwf-main.min.css
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://mwf-service.akamaized.net/mwf/js/bundle/1.57.0/mwf-auto-init-main.var.min.js
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://optanon.blob.core.windows.net/skins/4.1.0/default_flat_top_two_button_black/v2/css/optanon.c
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://optanon.blob.core.windows.net/skins/4.1.0/default_flat_top_two_button_black/v2/images/cookie
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364737158.0000000003F1C000.00000004.00000001.sdmp String found in binary or memory: https://payments.google.com/
Source: 26FF190E7AE0F7C7.exe String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.360425883.0000000003F11000.00000004.00000001.sdmp String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.jstW2
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://pki.goog/repository/0
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://play.google.com/intl/en_us/badges/images/generic/de_badge_web_generic.png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://prod-video-cms-rt-microsoft-com.akamaized.net/vhs/api/videos/RE4sQBc
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364737158.0000000003F1C000.00000004.00000001.sdmp String found in binary or memory: https://sandbox.google.com/
Source: 26FF190E7AE0F7C7.exe String found in binary or memory: https://sandbox.google.com/payments/v4/js/integr
Source: 26FF190E7AE0F7C7.exe String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.360425883.0000000003F11000.00000004.00000001.sdmp String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.jsuSS4
Source: Web Data1618258532140.6.dr String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: Web Data1618258532140.6.dr String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://srtb.msn.com/auction?a=de-ch&b=fa1a6a09db4c4f6fbf480b78c51caf60&c=MSN&d=http%3A%2F%2Fwww.msn
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://statics-marketingsites-neu-ms-com.akamaized.net/statics/override.css?c=7
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.377355169.0000000003EF8000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.377302172.0000000003FE1000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000006.00000003.435810988.0000000003EE3000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.435810988.0000000003EE3000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_flashM
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.377145745.0000000004090000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_java
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.435810988.0000000003EE3000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_pdf
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.377145745.0000000004090000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_real
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.377355169.0000000003EF8000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_wmp
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.377302172.0000000003FE1000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000006.00000003.435810988.0000000003EE3000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.435810988.0000000003EE3000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/answer/6258784U
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://twitter.com/
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://twitter.com/compose/tweetsec-fetch-dest:
Source: 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://twitter.com/compose/tweetsec-fetch-mode:
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://twitter.com/ookie:
Source: 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://twitter.comReferer:
Source: 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://twitter.comsec-fetch-dest:
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://upload.twitter.com/i/media/upload.json
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://upload.twitter.com/i/media/upload.json%dcommand=INIT&total_bytes=&media_type=image%2Fjpeg&me
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://upload.twitter.com/i/media/upload.json?command=APPEND&media_id=%s&segment_index=0
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://upload.twitter.com/i/media/upload.json?command=APPEND&media_id=%s&segment_index=0accept:
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://upload.twitter.com/i/media/upload.jsoncommand=FINALIZE&media_id=
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp, ecv5AA4.tmp.11.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google-analytics.com/gtm/js?id=GTM-N7S69J3&cid=1824632442.1601478955
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364667666.0000000003F55000.00000004.00000001.sdmp String found in binary or memory: https://www.google.com
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.360425883.0000000003F11000.00000004.00000001.sdmp, ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/application/x-msdownloadC:
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/css/main.v2.min.css
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/css/main.v3.min.css
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/app-store-download.png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/chrome-logo.svg
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/chrome_safari-behavior.jpg
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/chrome_throbber_fast.gif
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/cursor-replay.cur
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/download-browser/big_pixel_phone.png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/download-browser/pixel_phone.png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/download-browser/pixel_tablet.png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/fallback/google-chrome-logo.jpg
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/fallback/google-logo-one-color.jpg
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-description-white-blue-bg.jpg
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-fb.jpg
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-file-download.jpg
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-help.jpg
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-twitter.jpg
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-youtube.jpg
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/favicons/favicon-16x16.png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/folder-applications.svg
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/google-play-download.png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-beta.png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-canary.png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-dev.png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-enterprise.png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/homepage/hero-anim-bottom-left.png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/homepage/hero-anim-middle.png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/homepage/hero-anim-top-right.png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/homepage/homepage_features.png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/homepage/homepage_privacy.png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/homepage/homepage_tools.png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/homepage/laptop_desktop.png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/icon-announcement.svg
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/icon-file-download.svg
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/mac-ico.png
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/images/thank-you/thankyou-animation.json
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/js/installer.min.js
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/static/js/main.v2.min.js
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=0
Source: 26FF190E7AE0F7C7.exe, 26FF190E7AE0F7C7.exe, 00000007.00000003.364737158.0000000003F1C000.00000004.00000001.sdmp String found in binary or memory: https://www.google.com/cloudprint
Source: 26FF190E7AE0F7C7.exe String found in binary or memory: https://www.google.com/cloudprint/enab
Source: 26FF190E7AE0F7C7.exe String found in binary or memory: https://www.google.com/cloudprint/enable_chrome_connector
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364737158.0000000003F1C000.00000004.00000001.sdmp String found in binary or memory: https://www.google.com/cloudprint/enable_chrome_connectorfL
Source: Web Data1618258532140.6.dr String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364667666.0000000003F55000.00000004.00000001.sdmp String found in binary or memory: https://www.google.com;
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.googleadservices.com/pagead/conversion.js
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.googleadservices.com/pagead/conversion_async.js
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.googleadservices.com/pagead/p3p.xml
Source: 26FF190E7AE0F7C7.exe, 26FF190E7AE0F7C7.exe, 00000007.00000003.364737158.0000000003F1C000.00000004.00000001.sdmp String found in binary or memory: https://www.googleapis.com/
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364667666.0000000003F55000.00000004.00000001.sdmp String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364667666.0000000003F55000.00000004.00000001.sdmp String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: 26FF190E7AE0F7C7.exe, 26FF190E7AE0F7C7.exe, 00000007.00000003.364737158.0000000003F1C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000003.364704865.0000000003F3A000.00000004.00000001.sdmp String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: 26FF190E7AE0F7C7.exe String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.360425883.0000000003F11000.00000004.00000001.sdmp String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonlymdVA
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364667666.0000000003F55000.00000004.00000001.sdmp String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: 26FF190E7AE0F7C7.exe String found in binary or memory: https://www.googleapis.com/auth/h
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364667666.0000000003F55000.00000004.00000001.sdmp String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364667666.0000000003F55000.00000004.00000001.sdmp String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364667666.0000000003F55000.00000004.00000001.sdmp String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364828716.0000000003F43000.00000004.00000001.sdmp String found in binary or memory: https://www.googleapis.com/auth/meetingsP)
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.360425883.0000000003F11000.00000004.00000001.sdmp String found in binary or memory: https://www.googleapis.com/auth/meetingsn)H
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364667666.0000000003F55000.00000004.00000001.sdmp String found in binary or memory: https://www.googleapis.com/auth/plus.peopK
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364667666.0000000003F55000.00000004.00000001.sdmp String found in binary or memory: https://www.googleapis.com/auth/plus.peopKK
Source: 26FF190E7AE0F7C7.exe String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwri
Source: 26FF190E7AE0F7C7.exe, 26FF190E7AE0F7C7.exe, 00000007.00000003.364118495.0000000003F59000.00000004.00000001.sdmp String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.360425883.0000000003F11000.00000004.00000001.sdmp String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwriteVOs
Source: 26FF190E7AE0F7C7.exe String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.360425883.0000000003F11000.00000004.00000001.sdmp String found in binary or memory: https://www.googleapis.com/auth/sierra85.0.
Source: 26FF190E7AE0F7C7.exe, 26FF190E7AE0F7C7.exe, 00000007.00000003.364704865.0000000003F3A000.00000004.00000001.sdmp String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364667666.0000000003F55000.00000004.00000001.sdmp String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=UA-26908291-4
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=GTM-PZ6TRJB
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.gstatic.com/external_hosted/autotrack/autotrack.js
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.gstatic.com/external_hosted/lottie/lottie.js
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.gstatic.com/external_hosted/modernizr/modernizr.js
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.gstatic.com/external_hosted/scrollmagic/ScrollMagic.min.js
Source: ecv5AA4.tmp.11.dr String found in binary or memory: https://www.gstatic.com/external_hosted/scrollmagic/animation.gsap.min.js
Source: 26FF190E7AE0F7C7.exe, 00000007.00000003.364667666.0000000003F55000.00000004.00000001.sdmp String found in binary or memory: https://www.gstatic.com;
Source: 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://www.instagram.com/
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://www.instagram.com/accept:
Source: 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://www.instagram.com/accounts/login/ajax/facebook/
Source: 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://www.instagram.com/graphql/query/?query_hash=149bef52a3b2af88c0fec37913fe1cbc&variables=%7B%2
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://www.instagram.com/sec-fetch-site:
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://www.instagram.comsec-fetch-mode:
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://www.messenger.com
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://www.messenger.com/
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://www.messenger.com/accept:
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://www.messenger.com/login/nonce/
Source: 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://www.messenger.com/origin:
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp String found in binary or memory: https://www.messenger.comhttps://www.messenger.com/login/nonce/ookie:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Contains functionality for read data from the clipboard
Source: C:\Users\user\AppData\Roaming\1618258522437.exe Code function: 11_2_0040AE4D OpenClipboard, 11_2_0040AE4D
Creates a DirectInput object (often for capturing keystrokes)
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000002.354220251.000000000074A000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

barindex
Registers a new ROOT certificate
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_1001F780 CryptStringToBinaryA,CryptStringToBinaryA,CertCreateCertificateContext,CertOpenStore,CertAddCertificateContextToStore,GetLastError,CertGetCertificateContextProperty,_memset,CertGetCertificateContextProperty,_memset,_memset,_sprintf,_sprintf,CertCloseStore,CertFreeCertificateContext, 0_2_1001F780

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 6.2.26FF190E7AE0F7C7.exe.3140000.7.unpack, type: UNPACKEDPE Matched rule: APT34_PICKPOCKET Author: unknown
Source: 7.2.26FF190E7AE0F7C7.exe.3170000.7.unpack, type: UNPACKEDPE Matched rule: APT34_PICKPOCKET Author: unknown
PE file has a writeable .text section
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 26FF190E7AE0F7C7.exe.0.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Contains functionality to call native functions
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_1001A000 LoadLibraryA,GetProcAddress,GetCurrentProcess,NtQueryInformationProcess, 0_2_1001A000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_10019DA0 LoadLibraryA,GetProcAddress,GetCurrentThread,NtSetInformationThread, 0_2_10019DA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_10019F60 LoadLibraryA,GetProcAddress,GetCurrentProcess,NtQueryInformationProcess, 0_2_10019F60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_10019FB0 LoadLibraryA,GetProcAddress,GetCurrentProcess,NtQueryInformationProcess, 0_2_10019FB0
Source: C:\Users\user\AppData\Roaming\1618258522437.exe Code function: 11_2_0040C516 NtQuerySystemInformation, 11_2_0040C516
Source: C:\Users\user\AppData\Roaming\1618258522437.exe Code function: 11_2_0040C6FB memset,CreateFileW,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,FreeLibrary, 11_2_0040C6FB
Contains functionality to communicate with device drivers
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_00403660: DeviceIoControl, 0_2_00403660
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_00403E2C 0_2_00403E2C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_004093D5 0_2_004093D5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_1000C073 0_2_1000C073
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_1000B893 0_2_1000B893
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_10006100 0_2_10006100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_100099F0 0_2_100099F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_10007200 0_2_10007200
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_10016A1D 0_2_10016A1D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_10009267 0_2_10009267
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_10010AAC 0_2_10010AAC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_10008350 0_2_10008350
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_1000ABB0 0_2_1000ABB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_1000B3C0 0_2_1000B3C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_1000E3E0 0_2_1000E3E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_10008400 0_2_10008400
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_1001EC30 0_2_1001EC30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_1000BC67 0_2_1000BC67
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_1000C493 0_2_1000C493
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_100105F0 0_2_100105F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_1001EE3B 0_2_1001EE3B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_1000FFD1 0_2_1000FFD1
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_1000C073 6_2_1000C073
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_1000B893 6_2_1000B893
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_10006100 6_2_10006100
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_100099F0 6_2_100099F0
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_10007200 6_2_10007200
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_10016A1D 6_2_10016A1D
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_10009267 6_2_10009267
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_10010AAC 6_2_10010AAC
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_10008350 6_2_10008350
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_1000ABB0 6_2_1000ABB0
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_1000B3C0 6_2_1000B3C0
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_1000E3E0 6_2_1000E3E0
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_10008400 6_2_10008400
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_1001EC30 6_2_1001EC30
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_1000BC67 6_2_1000BC67
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_1000C493 6_2_1000C493
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_100105F0 6_2_100105F0
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_1001EE3B 6_2_1001EE3B
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_1000FFD1 6_2_1000FFD1
Source: C:\Users\user\AppData\Roaming\1618258522437.exe Code function: 11_2_00404BE4 11_2_00404BE4
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe Code function: 27_2_00B9A0C3 27_2_00B9A0C3
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe Code function: 27_2_00B9963B 27_2_00B9963B
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe Code function: 27_2_00B96A1E 27_2_00B96A1E
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe Code function: 27_2_00B9A7BB 27_2_00B9A7BB
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe Code function: 27_2_00B9B51C 27_2_00B9B51C
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe Code function: 27_2_00B99B7F 27_2_00B99B7F
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: String function: 10010594 appears 35 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: String function: 10010594 appears 35 times
PE file contains strange resources
Source: 1618258522437.exe.6.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 1618258522437.exe.6.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000000.329269561.0000000000412000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameVBCABLE_ControlPanel.exeJ vs SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000002.354164203.0000000000730000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamenlsbres.dllj% vs SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000002.354674338.0000000002120000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamenlsbres.dll.muij% vs SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Binary or memory string: OriginalFilenameVBCABLE_ControlPanel.exeJ vs SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe
Tries to load missing DLLs
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll Jump to behavior
Uses 32bit PE files
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Yara signature match
Source: 00000007.00000002.369233907.00000000025B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 00000000.00000002.355375911.00000000025D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 00000006.00000002.438715489.0000000002660000.00000040.00000001.sdmp, type: MEMORY Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 6.2.26FF190E7AE0F7C7.exe.2660000.5.raw.unpack, type: UNPACKEDPE Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 0.2.SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe.25d0000.4.unpack, type: UNPACKEDPE Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 0.2.SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe.10000000.6.unpack, type: UNPACKEDPE Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 6.2.26FF190E7AE0F7C7.exe.10000000.11.unpack, type: UNPACKEDPE Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 7.2.26FF190E7AE0F7C7.exe.25b0000.5.unpack, type: UNPACKEDPE Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 7.2.26FF190E7AE0F7C7.exe.10000000.11.unpack, type: UNPACKEDPE Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 7.2.26FF190E7AE0F7C7.exe.25b0000.5.raw.unpack, type: UNPACKEDPE Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 0.2.SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe.25d0000.4.raw.unpack, type: UNPACKEDPE Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 6.2.26FF190E7AE0F7C7.exe.2660000.5.unpack, type: UNPACKEDPE Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 6.2.26FF190E7AE0F7C7.exe.3140000.7.unpack, type: UNPACKEDPE Matched rule: APT34_PICKPOCKET Description = Detects the PICKPOCKET malware used by APT34, a browser credential-theft tool identified by FireEye in May 2018, Reference = https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html
Source: 7.2.26FF190E7AE0F7C7.exe.3170000.7.unpack, type: UNPACKEDPE Matched rule: APT34_PICKPOCKET Description = Detects the PICKPOCKET malware used by APT34, a browser credential-theft tool identified by FireEye in May 2018, Reference = https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html
Source: classification engine Classification label: mal93.bank.troj.spyw.evad.winEXE@32/37@98/2
Source: C:\Users\user\AppData\Roaming\1618258522437.exe Code function: 11_2_0040CE93 CreateToolhelp32Snapshot,memset,Process32FirstW,OpenProcess,OpenProcess,OpenProcess,memset,GetModuleHandleW,GetProcAddress,QueryFullProcessImageNameW,QueryFullProcessImageNameW,CloseHandle,Process32NextW,FindCloseChangeNotification, 11_2_0040CE93
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe Code function: 27_2_00B91058 CoCreateInstance, 27_2_00B91058
Source: C:\Users\user\AppData\Roaming\1618258522437.exe Code function: 11_2_0040D9FC FindResourceW,SizeofResource,LoadResource,LockResource, 11_2_0040D9FC
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File created: C:\Users\user\AppData\Local\Login Data1618258522140 Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5712:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6908:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6696:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\exist_sign_task_Hello002
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\exist_sign_task_Hello001
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7084:120:WilError_01
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\exist_sign__install_r3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe File created: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Jump to behavior
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\AppData\Roaming\1618258522437.exe System information queried: HandleInformation Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = &quot;chrome.exe&quot;)
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\win.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp Binary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Virustotal: Detection: 75%
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Metadefender: Detection: 25%
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe ReversingLabs: Detection: 64%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe File read: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe'
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Process created: C:\Windows\SysWOW64\msiexec.exe msiexec.exe /i 'C:\Users\user\AppData\Local\Temp\gdiview.msi'
Source: unknown Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 97BC0791AD59D06459021C46045665AB C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Process created: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe 0011 installp3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Process created: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe 200 installp3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ping 127.0.0.1 -n 3 & del 'C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Process created: C:\Users\user\AppData\Roaming\1618258522437.exe 'C:\Users\user\AppData\Roaming\1618258522437.exe' /sjson 'C:\Users\user\AppData\Roaming\1618258522437.txt'
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im chrome.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im chrome.exe
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ping 127.0.0.1 -n 3 & del 'C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Process created: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe ThunderFW 'C:\Users\user\AppData\Local\Temp\download\MiniThunderPlatform.exe'
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ping 127.0.0.1 -n 3 & del 'C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Process created: C:\Windows\SysWOW64\msiexec.exe msiexec.exe /i 'C:\Users\user\AppData\Local\Temp\gdiview.msi' Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Process created: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe 0011 installp3 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Process created: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe 200 installp3 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ping 127.0.0.1 -n 3 & del 'C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Process created: C:\Users\user\AppData\Roaming\1618258522437.exe 'C:\Users\user\AppData\Roaming\1618258522437.exe' /sjson 'C:\Users\user\AppData\Roaming\1618258522437.txt' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Process created: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe ThunderFW 'C:\Users\user\AppData\Local\Temp\download\MiniThunderPlatform.exe' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ping 127.0.0.1 -n 3 & del 'C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im chrome.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ping 127.0.0.1 -n 3 & del 'C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe' Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im chrome.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\msiexec.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{000C103E-0000-0000-C000-000000000046}\InProcServer32 Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Automated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exe Automated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exe Automated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exe Automated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exe Automated click: Install
Source: Window Recorder Window detected: More than 3 window changes detected
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Static file information: File size 4255416 > 1048576
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File opened: C:\Users\user\AppData\Local\Temp\download\msvcr71.dll Jump to behavior
Source: Binary string: d:\MiniTP\Src\MiniThunderPlatform\pdb\ProductForCommon\MiniThunderPlatform.pdb source: MiniThunderPlatform.exe.6.dr
Source: Binary string: c:\Projects\VS2005\EdgeCookiesView\Release\EdgeCookiesView.pdb source: 1618258522437.exe, 0000000B.00000000.357295730.000000000040F000.00000002.00020000.sdmp, 1618258522437.exe.6.dr
Source: Binary string: atl71.pdbT source: atl71.dll.6.dr
Source: Binary string: msvcr71.pdb\ source: msvcr71.dll.6.dr
Source: Binary string: atl71.pdb source: atl71.dll.6.dr
Source: Binary string: cmd_insert_server.icex-conference/x-cooltalk.movievideo/x-sgi-movievideo/x-msvideo.mxuvideo/vnd.mpegurl.qtvideo/quicktimevideo/mpeg.xmltext/xml.etxtext/x-setext.wmlstext/vnd.wap.wmlscript.wmltext/vnd.wap.wml.tsvtext/tab-separated-values.sgmtext/sgml.rtftext/rtf.rtxtext/richtext.txttext/plain.html.csstext/css.mshmodel/mesh.igsmodel/iges.xwdimage/x-xwindowdump.xpmimage/x-xpixmap.xbmimage/x-xbitmap.rgbimage/x-rgb.ppmimage/x-portable-pixmap.bgmimage/x-portable-graymap.pbmimage/x-portable-bitmap.pnmimage/x-portable-anymap.rasimage/x-cmu-raster.wbmpimage/vnd.wap.wbmp.djvimage/vnd.djvu.tiffimage/tiff.pngimage/png.jpgimage/jpeg.iefimage/ief.gifimage/gif.bmpimage/bmp.xyzchemical/x-xyz.pdbchemical/x-pdb.wavaudio/x-wavaudio/x-realaudio.arpmaudio/x-pn-realaudio-pluginaudio/x-pn-realaudio.m3uaudio/x-mpegurl.aifaudio/x-aiffaudio/mpeg.midiaudio/midiapplication/application/zip.xhtmlapplication/xhtml+xml.srcapplication/x-wais-source.ustarapplication/x-ustar.msapplication/x-troff-ms.meapplication/x-troff-me.manapplication/x-troff-man.texiapplication/x-texinfo.texapplication/x-tex.tclapplication/x-tclapplication/x-tar.sv4crcapplication/x-sv4crc.sv4cpioapplication/x-sv4cpio.sitapplication/x-stuffit.swfapplication/x-shockwave-flash.sharapplication/x-shar.shapplication/x-sh.latexapplication/x-latex.jsapplication/x-javascript.hdfapplication/x-hdf.gtarapplication/x-gtar.splapplication/x-futuresplash.dviapplication/x-dvi.cshapplication/x-csh.cpioapplication/x-cpio.pgnapplication/x-chess-pgn.vcdapplication/x-cdlink.bcpioapplication/x-bcpio.wmlscapplication/vnd.wap.wmlscriptc.wmlcapplication/vnd.wap.wmlc.wbxmlapplication/vnd.wap.wbxml.pptapplication/vnd.ms-powerpoint.xlsapplication/vnd.ms-excel.mifapplication/vnd.mif.smiapplication/smil.pdfapplication/pdf.odaapplication/oda.docapplication/msword.cptapplication/mac-compactpro.hqxapplication/mac-binhex40.ezapplication/andrew-inset source: download_user.dll.6.dr
Source: Binary string: d:\MiniDownloadLib\branches\bin\Product Release\download_user.pdb source: download_user.dll.6.dr
Source: Binary string: f:\sys\objfre_wxp_x86\i386\FsFilter32.pdbpJ source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp
Source: Binary string: d:\MiniTP\Src\MiniThunderPlatform\pdb\ProductForCommon\MiniThunderPlatform.pdbt source: MiniThunderPlatform.exe.6.dr
Source: Binary string: d:\MiniTP\Src\MiniThunderPlatform\pdb\ProductForCommon\xldl.pdb source: xldl.dll.6.dr
Source: Binary string: msvcp71.pdb source: msvcp71.dll.6.dr
Source: Binary string: e:\xl7\Product Release\dl_peer_id.pdb0 source: dl_peer_id.dll.6.dr
Source: Binary string: f:\sys\objfre_wxp_x86\i386\FsFilter32.pdb source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp
Source: Binary string: d:\workspace\xlframework\win32_component\ThunderFW\Release\ThunderFW.pdb source: ThunderFW.exe, 0000001B.00000002.420452829.0000000000B9C000.00000002.00020000.sdmp, ThunderFW.exe.6.dr
Source: Binary string: f:\sys\objfre_win7_amd64\amd64\FsFilter64.pdb source: 26FF190E7AE0F7C7.exe, 00000006.00000002.439843549.000000000330C000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.370303228.000000000333C000.00000004.00000001.sdmp
Source: Binary string: e:\xl7\Product Release\dl_peer_id.pdb source: dl_peer_id.dll.6.dr
Source: Binary string: msvcr71.pdb source: msvcr71.dll.6.dr
Source: Binary string: d:\BranchAI\launcher\Release\fileLauncher.pdb source: MSI39DD.tmp.3.dr

Data Obfuscation:

barindex
Detected unpacking (creates a PE file in dynamic memory)
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Unpacked PE file: 6.2.26FF190E7AE0F7C7.exe.2660000.5.unpack
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_00408D68 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_00408D68
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_00403E2C push edx; ret 0_2_0040411C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_00404042 push edx; ret 0_2_0040411C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_004040D9 push edx; ret 0_2_0040411C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_004038A0 push eax; ret 0_2_004038CE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_00403FA9 push edx; ret 0_2_0040411C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_100105D9 push ecx; ret 0_2_100105EC
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 3_2_0521F289 push edx; retf 3_2_0521F2D0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 3_2_07E3F129 push edx; retf 3_2_07E3F170
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_100105D9 push ecx; ret 6_2_100105EC
Source: C:\Users\user\AppData\Roaming\1618258522437.exe Code function: 11_2_0040E2F1 push ecx; ret 11_2_0040E301
Source: C:\Users\user\AppData\Roaming\1618258522437.exe Code function: 11_2_0040E340 push eax; ret 11_2_0040E354
Source: C:\Users\user\AppData\Roaming\1618258522437.exe Code function: 11_2_0040E340 push eax; ret 11_2_0040E37C
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe Code function: 27_2_00B93FB5 push ecx; ret 27_2_00B93FC8

Persistence and Installation Behavior:

barindex
Contains functionality to infect the boot sector
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: _memset,wsprintfW,CreateFileW,DeviceIoControl,_memset,CloseHandle,CloseHandle, \\.\PhysicalDrive%d 0_2_1001D840
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: wsprintfW,CreateFileW,_memset,DeviceIoControl,_memset,FindCloseChangeNotification, \\.\PhysicalDrive%d 0_2_1001DAD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: wsprintfW,CreateFileW,DeviceIoControl,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d 0_2_1001D3D0
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: _memset,wsprintfW,CreateFileW,DeviceIoControl,_memset,CloseHandle,CloseHandle, \\.\PhysicalDrive%d 6_2_1001D840
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: wsprintfW,CreateFileW,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PhysicalDrive%d 6_2_1001DAD0
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: wsprintfW,CreateFileW,DeviceIoControl,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d 6_2_1001D3D0
Installs new ROOT certificates
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD Blob Jump to behavior
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File created: C:\Users\user\AppData\Local\Temp\download\dl_peer_id.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File created: C:\Users\user\AppData\Local\Temp\download\download_user.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File created: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File created: C:\Users\user\AppData\Local\Temp\download\msvcp71.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File created: C:\Users\user\AppData\Local\Temp\xldl.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe File created: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe File created: C:\Users\user\AppData\Local\Temp\MSI39DD.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File created: C:\Users\user\AppData\Roaming\1618258522437.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File created: C:\Users\user\AppData\Local\Temp\download\MiniThunderPlatform.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File created: C:\Users\user\AppData\Local\Temp\download\atl71.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File created: C:\Users\user\AppData\Local\Temp\download\msvcr71.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File created: C:\Users\user\AppData\Local\Temp\download\zlib1.dll Jump to dropped file
Installs a Chrome extension
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cgnliiolndkgeojpohkplpfbdgnhnmaa Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cgnliiolndkgeojpohkplpfbdgnhnmaa\1.0.0.0_0 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cgnliiolndkgeojpohkplpfbdgnhnmaa\1.0.0.0_0\icon.png Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cgnliiolndkgeojpohkplpfbdgnhnmaa\1.0.0.0_0\icon48.png Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cgnliiolndkgeojpohkplpfbdgnhnmaa\1.0.0.0_0\popup.html Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cgnliiolndkgeojpohkplpfbdgnhnmaa\1.0.0.0_0\background.js Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cgnliiolndkgeojpohkplpfbdgnhnmaa\1.0.0.0_0\book.js Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cgnliiolndkgeojpohkplpfbdgnhnmaa\1.0.0.0_0\jquery-1.8.3.min.js Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cgnliiolndkgeojpohkplpfbdgnhnmaa\1.0.0.0_0\popup.js Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cgnliiolndkgeojpohkplpfbdgnhnmaa\1.0.0.0_0\manifest.json Jump to behavior

Boot Survival:

barindex
Contains functionality to infect the boot sector
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: _memset,wsprintfW,CreateFileW,DeviceIoControl,_memset,CloseHandle,CloseHandle, \\.\PhysicalDrive%d 0_2_1001D840
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: wsprintfW,CreateFileW,_memset,DeviceIoControl,_memset,FindCloseChangeNotification, \\.\PhysicalDrive%d 0_2_1001DAD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: wsprintfW,CreateFileW,DeviceIoControl,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d 0_2_1001D3D0
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: _memset,wsprintfW,CreateFileW,DeviceIoControl,_memset,CloseHandle,CloseHandle, \\.\PhysicalDrive%d 6_2_1001D840
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: wsprintfW,CreateFileW,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PhysicalDrive%d 6_2_1001DAD0
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: wsprintfW,CreateFileW,DeviceIoControl,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d 6_2_1001D3D0

Hooking and other Techniques for Hiding and Protection:

barindex
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\AppData\Roaming\1618258522437.exe Code function: 11_2_0040C41D GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 11_2_0040C41D
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\SysWOW64\msiexec.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\1618258522437.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Contains functionality to detect sleep reduction / modifications
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_10020600 0_2_10020600
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_10020600 6_2_10020600
Uses ping.exe to sleep
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Contains functionality to read device registry values (via SetupAPI)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_100197E0 SetupDiGetDeviceRegistryPropertyA,GetLastError,_memset,SetupDiGetDeviceRegistryPropertyA, 0_2_100197E0
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\download\dl_peer_id.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\download\download_user.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\download\msvcp71.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xldl.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\download\MiniThunderPlatform.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\download\atl71.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\download\msvcr71.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\download\zlib1.dll Jump to dropped file
May check if the current machine is a sandbox (GetTickCount - Sleep)
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_10020600 6_2_10020600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_10020600 0_2_10020600
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe TID: 6632 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe TID: 6984 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe TID: 6984 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe TID: 7020 Thread sleep time: -30000s >= -30000s Jump to behavior
Queries disk information (often used to detect virtual machines)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe File opened: PhysicalDrive0 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Uses the system / local time for branch decision (may execute only at specific dates)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_10022710 GetLocalTime followed by cmp: cmp dword ptr [ebp-000002a0h], 06h and CTI: ja 10022C96h 0_2_10022710
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_10022710 GetLocalTime followed by cmp: cmp dword ptr [ebp-000002a0h], 06h and CTI: ja 10022C96h 6_2_10022710
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_1001A1D0 FindFirstFileA,FindClose, 0_2_1001A1D0
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_1001A1D0 FindFirstFileA,FindClose, 6_2_1001A1D0
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Google\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.372974513.0000000003EE1000.00000004.00000001.sdmp Binary or memory string: Motherboard resourcesSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft AC AdapterBatteryACPI{72631e54-78a4-11d0-bcf7-00aa00b7b32a}Intel(R) 82574L Gigabit Network ConnectionNetPCIIntel(R) 82574L Gigabit Network Connection{4d36e972-e325-11ce-bfc1-08002be10318}LSI Adapter, SAS 3000 series, 8-port with 1068SCSIAdapterPCI{4d36e97b-e325-11ce-bfc1-08002be10318}PCI-to-PCI BridgeSystemPCI{4d36e97d-e325-11ce-bfc1-08002be10318}Local Print QueuePrintQueueSWDMicrosoft XPS Document Writer{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDRoot Print Queue{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Volume ManagerSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Generic Non-PnP MonitorMonitorDISPLAY{4d36e96e-e325-11ce-bfc1-08002be10318}WAN Miniport (PPPOE)NetSWDWAN Miniport (PPPOE){4d36e972-e325-11ce-bfc1-08002be10318}PCI BusSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Basic Display DriverSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.435810988.0000000003EE3000.00000004.00000001.sdmp Binary or memory string: Microsoft Hyper-V Generation CounterSystemACPI
Source: SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe, 00000000.00000002.354220251.000000000074A000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllX
Source: 26FF190E7AE0F7C7.exe, 00000006.00000002.437667421.00000000021EC000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.369845162.00000000029DC000.00000004.00000001.sdmp Binary or memory string: Microsoft Hyper-V Generation CounterSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.354177238.0000000002C81000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000003.356504806.0000000002CC1000.00000004.00000001.sdmp Binary or memory string: NetPCIIntel(R) 82574L Gigabit Network Connection{4d36e972-e325-11ce-bfc1-08002be10318}LSI Adapter, SAS 3000 series, 8-port with 1068SCSIAdapterPCI{4d36e97b-e325-11ce-bfc1-08002be10318}PCI-to-PCI BridgeSystemPCI{4d36e97d-e325-11ce-bfc1-08002be10318}Local Print QueuePrintQueueSWDMicrosoft XPS Document Writer{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDRoot Print Queue{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Volume ManagerSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Generic Non-PnP MonitorMonitorDISPLAY{4d36e96e-e325-11ce-bfc1-08002be10318}WAN Miniport (PPPOE)NetSWDWAN Miniport (PPPOE){4d36e972-e325-11ce-bfc1-08002be10318}PCI BusSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Basic Display DriverSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}USB Input DeviceHIDClassUSB{745a17a0-74d3-11d0-b6fe-00a0c90f57da}VolumeVolumeSTORAGE{71a27cdd-812a-11d0-bec7-08002be2092f}USB Root Hub (USB 3.0)USBUSB{36fc9e60-c465-11cf-8056-444553540000}Generic software deviceSoftwareDeviceSWDMicrosoft RRAS Root Enumerator{62f9c741-b25a-46ce-b54c-9bccce08b6f2}WAN Miniport (PPTP)NetSWDWAN Miniport (PPTP){4d36e972-e325-11ce-bfc1-08002be10318}High precision event timerSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}WAN Miniport (IKEv2)NetSWDWAN Miniport (IKEv2){4d36e972-e325-11ce-bfc1-08002be10318}Composite Bus EnumeratorSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Virtual Drive EnumeratorSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Storage Spaces ControllerSCSIAdapterROOT{4d36e97b-e325-11ce-bfc1-08002be10318}System CMOS/real time clockSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Kernel Debug Network AdapterNetROOTMicrosoft Kernel Debug Network Adapter{4d36e972-e325-11ce-bfc1-08002be10318}Standard PS/2 KeyboardKeyboardACPI{4d36e96b-e325-11ce-bfc1-08002be10318}USB Input DeviceHIDClassUSB{745a17a0-74d3-11d0-b6fe-00a0c90f57da}Local Print QueuePrintQueue
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.354308871.0000000002CAD000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000003.356638166.00000000029D9000.00000004.00000001.sdmp Binary or memory string: Microsoft Hyper-V Generation Counter
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.372974513.0000000003EE1000.00000004.00000001.sdmp Binary or memory string: NetPCIIntel(R) 82574L Gigabit Network Connection{4d36e972-e325-11ce-bfc1-08002be10318}LSI Adapter, SAS 3000 series, 8-port with 1068SCSIAdapterPCI{4d36e97b-e325-11ce-bfc1-08002be10318}PCI-to-PCI BridgeSystemPCI{4d36e97d-e325-11ce-bfc1-08002be10318}Local Print QueuePrintQueueSWDMicrosoft XPS Document Writer{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDRoot Print Queue{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Volume ManagerSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Generic Non-PnP MonitorMonitorDISPLAY{4d36e96e-e325-11ce-bfc1-08002be10318}WAN Miniport (PPPOE)NetSWDWAN Miniport (PPPOE){4d36e972-e325-11ce-bfc1-08002be10318}PCI BusSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}
Source: 26FF190E7AE0F7C7.exe, 00000007.00000002.366902451.000000000019B000.00000004.00000010.sdmp Binary or memory string: VMware Virtual disk 2.0
Source: ecv5AA4.tmp.11.dr Binary or memory string: https://arc.msn.com/v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=314559&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20200930T152707Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=0b92160dd3c5481e9e32e6096321eb20&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=663574&metered=false&nettype=ethernet&npid=sc-314559&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&smBiosDm=VMware7%2C1&tl=2&tsu=663574&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=
Source: 26FF190E7AE0F7C7.exe, 00000007.00000002.366902451.000000000019B000.00000004.00000010.sdmp Binary or memory string: VMware
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.354357910.00000000021E9000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000003.356638166.00000000029D9000.00000004.00000001.sdmp Binary or memory string: {72631e54-78a4-11d0-bcf7-00aa00b7b32a}Intel(R) 82574L Gigabit Network ConnectionNetPCIIntel(R) 82574L Gigabit Network Connection{4d36e972-e325-11ce-bfc1-08002be10318}LSI Adapter, SAS 3000 series, 8-port with 1068SCSIAdapterPCI{4d36e97b-e325-11ce-bfc1-08002be10318}PCI-to-PCI BridgeSystemPCI{4d36e97d-e325-11ce-bfc1-08002be10318}Local Print QueuePrintQueueSWDMicrosoft XPS Document Writer{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDRoot Print Queue{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Volume ManagerSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Generic Non-PnP MonitorMonitorDISPLAY{4d36e96e-e325-11ce-bfc1-08002be10318}WAN Miniport (PPPOE)NetSWDWAN Miniport (PPPOE){4d36e972-e325-11ce-bfc1-08002be10318}PCI BusSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.354308871.0000000002CAD000.00000004.00000001.sdmp, 26FF190E7AE0F7C7.exe, 00000007.00000002.369921364.0000000002CED000.00000004.00000001.sdmp Binary or memory string: Motherboard resourcesSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft AC AdapterBatteryACPI{72631e54-78a4-11d0-bcf7-00aa00b7b32a}Intel(R) 82574L Gigabit Network ConnectionNetPCIIntel(R) 82574L Gigabit Network Connection{4d36e972-e325-11ce-bfc1-08002be10318}LSI Adapter, SAS 3000 series, 8-port with 1068SCSIAdapterPCI{4d36e97b-e325-11ce-bfc1-08002be10318}PCI-to-PCI BridgeSystemPCI{4d36e97d-e325-11ce-bfc1-08002be10318}Local Print QueuePrintQueueSWDMicrosoft XPS Document Writer{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDRoot Print Queue{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Volume ManagerSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Generic Non-PnP MonitorMonitorDISPLAY{4d36e96e-e325-11ce-bfc1-08002be10318}WAN Miniport (PPPOE)NetSWDWAN Miniport (PPPOE){4d36e972-e325-11ce-bfc1-08002be10318}PCI BusSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Basic Display DriverSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}USB Input DeviceHIDClassUSB{745a17a0-74d3-11d0-b6fe-00a0c90f57da}VolumeVolumeSTORAGE{71a27cdd-812a-11d0-bec7-08002be2092f}USB Root Hub (USB 3.0)USBUSB{36fc9e60-c465-11cf-8056-444553540000}Generic software deviceSoftwareDeviceSWDMicrosoft RRAS Root Enumerator{62f9c741-b25a-46ce-b54c-9bccce08b6f2}WAN Miniport (PPTP)NetSWDWAN Miniport (PPTP){4d36e972-e325-11ce-bfc1-08002be10318}High precision event timerSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}WAN Miniport (IKEv2)NetSWDWAN Miniport (IKEv2){4d36e972-e325-11ce-bfc1-08002be10318}Composite Bus EnumeratorSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Virtual Drive EnumeratorSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Storage Spaces ControllerSCSIAdapterROOT{4d36e97b-e325-11ce-bfc1-08002be10318}System CMOS/real time clockSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Kernel Debug Network AdapterNetROOTMicrosoft Kernel Debug Network Adapter{4d36e972-e325-11ce-bfc1-08002be10318}Standard PS/2 KeyboardKeyboardACPI{4d36e96b-e325-11ce-bfc1-08002be10318}USB Input DeviceHIDClassUSB{745a17a0-74d3-11d0-b6fe-00a0c90f57da}Local Print QueuePrintQueueSWDMicrosoft Print to PDF{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}
Source: 26FF190E7AE0F7C7.exe, 00000006.00000003.376977232.0000000003F25000.00000004.00000001.sdmp Binary or memory string: {4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}p
Source: C:\Users\user\AppData\Roaming\1618258522437.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_1001A050 GetCurrentProcess,CheckRemoteDebuggerPresent, 0_2_1001A050
Hides threads from debuggers
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Thread information set: HideFromDebugger Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Process queried: DebugObjectHandle Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Process queried: DebugFlags Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_1000F05C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_1000F05C
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_00408D68 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_00408D68
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_00404E19 mov eax, dword ptr fs:[00000030h] 0_2_00404E19
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_10019E40 mov eax, dword ptr fs:[00000030h] 0_2_10019E40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_10019E70 mov eax, dword ptr fs:[00000030h] 0_2_10019E70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_10019E70 mov eax, dword ptr fs:[00000030h] 0_2_10019E70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_10019ED0 mov eax, dword ptr fs:[00000030h] 0_2_10019ED0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_10019ED0 mov eax, dword ptr fs:[00000030h] 0_2_10019ED0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_10019F30 mov eax, dword ptr fs:[00000030h] 0_2_10019F30
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_10019E40 mov eax, dword ptr fs:[00000030h] 6_2_10019E40
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_10019E70 mov eax, dword ptr fs:[00000030h] 6_2_10019E70
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_10019E70 mov eax, dword ptr fs:[00000030h] 6_2_10019E70
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_10019ED0 mov eax, dword ptr fs:[00000030h] 6_2_10019ED0
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_10019ED0 mov eax, dword ptr fs:[00000030h] 6_2_10019ED0
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_10019F30 mov eax, dword ptr fs:[00000030h] 6_2_10019F30
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_1000E96E GetProcessHeap,GetProcessHeap,HeapAlloc,GetVersionExA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,__heap_term,__RTC_Initialize,GetCommandLineA,___crtGetEnvironmentStringsA,__ioinit,__mtterm,__setargv,__setenvp,__cinit,__ioterm, 0_2_1000E96E
Enables debug privileges
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_1000F05C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_1000F05C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_100153B4 SetUnhandledExceptionFilter,__encode_pointer, 0_2_100153B4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_100153D6 __decode_pointer,SetUnhandledExceptionFilter, 0_2_100153D6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_10018473 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind, 0_2_10018473
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_1000E4AD _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_1000E4AD
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_1000F05C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 6_2_1000F05C
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_100153B4 SetUnhandledExceptionFilter,__encode_pointer, 6_2_100153B4
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_100153D6 __decode_pointer,SetUnhandledExceptionFilter, 6_2_100153D6
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_10018473 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind, 6_2_10018473
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: 6_2_1000E4AD _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 6_2_1000E4AD
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe Code function: 27_2_00B9461F SetUnhandledExceptionFilter, 27_2_00B9461F
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe Code function: 27_2_00B91C57 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 27_2_00B91C57
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe Code function: 27_2_00B9373A _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 27_2_00B9373A
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe Code function: 27_2_00B9631F __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 27_2_00B9631F

HIPS / PFW / Operating System Protection Evasion:

barindex
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im chrome.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Uses taskkill to terminate processes
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im chrome.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_1001A150 InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateMutexA,GetLastError, 0_2_1001A150

Language, Device and Operating System Detection:

barindex
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_100177FF cpuid 0_2_100177FF
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: GetLocaleInfoA, 0_2_10017D50
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Code function: GetLocaleInfoA, 6_2_10017D50
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe Code function: GetLocaleInfoA, 27_2_00B97189
Queries device information via Setup API
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_100197E0 SetupDiGetDeviceRegistryPropertyA,GetLastError,_memset,SetupDiGetDeviceRegistryPropertyA, 0_2_100197E0
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_100152B4 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter, 0_2_100152B4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Code function: 0_2_00401000 GetVersionExA,GetVersionExA,GetVersionExA,GetVersionExA, 0_2_00401000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\hihistory Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\26FF190E7AE0F7C7.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 385405 Sample: SecuriteInfo.com.Trojan.Sig... Startdate: 12/04/2021 Architecture: WINDOWS Score: 93 107 Malicious sample detected (through community Yara rule) 2->107 109 Multi AV Scanner detection for submitted file 2->109 111 Machine Learning detection for sample 2->111 113 2 other signatures 2->113 8 SecuriteInfo.com.Trojan.Siggen12.33370.30028.exe 1 3 2->8         started        13 msiexec.exe 2->13         started        process3 dnsIp4 71 c431a802ff4a46b5.com 8->71 73 bdc347c728b2d94d.com 8->73 75 5 other IPs or domains 8->75 67 C:\Users\user\...\26FF190E7AE0F7C7.exe, PE32 8->67 dropped 69 C:\...\26FF190E7AE0F7C7.exe:Zone.Identifier, ASCII 8->69 dropped 115 Installs new ROOT certificates 8->115 117 Contains functionality to infect the boot sector 8->117 119 Registers a new ROOT certificate 8->119 121 3 other signatures 8->121 15 26FF190E7AE0F7C7.exe 26 8->15         started        20 26FF190E7AE0F7C7.exe 1 15 8->20         started        22 cmd.exe 1 8->22         started        24 msiexec.exe 4 8->24         started        file5 signatures6 process7 dnsIp8 77 c431a802ff4a46b5.com 15->77 79 bdc347c728b2d94d.com 15->79 87 11 other IPs or domains 15->87 53 C:\Users\user\AppData\...\1618258522437.exe, PE32 15->53 dropped 55 C:\Users\user\AppData\Local\Temp\xldl.dll, PE32 15->55 dropped 57 C:\Users\user\AppData\Local\...\zlib1.dll, PE32 15->57 dropped 65 7 other files (none is malicious) 15->65 dropped 91 Multi AV Scanner detection for dropped file 15->91 93 Detected unpacking (creates a PE file in dynamic memory) 15->93 95 Machine Learning detection for dropped file 15->95 105 2 other signatures 15->105 26 cmd.exe 15->26         started        29 1618258522437.exe 2 15->29         started        31 ThunderFW.exe 15->31         started        81 c431a802ff4a46b5.com 20->81 83 bdc347c728b2d94d.com 20->83 89 6 other IPs or domains 20->89 59 C:\Users\user\AppData\...\Secure Preferences, UTF-8 20->59 dropped 61 C:\Users\user\AppData\Local\...\Preferences, ASCII 20->61 dropped 97 Tries to harvest and steal browser information (history, passwords, etc) 20->97 33 cmd.exe 1 20->33         started        35 cmd.exe 1 20->35         started        85 127.0.0.1 unknown unknown 22->85 99 Uses ping.exe to sleep 22->99 101 Uses ping.exe to check the status of other devices and networks 22->101 37 conhost.exe 22->37         started        39 PING.EXE 1 22->39         started        63 C:\Users\user\AppData\Local\...\MSI39DD.tmp, PE32 24->63 dropped file9 103 Tries to resolve many domain names, but no domain seems valid 79->103 signatures10 process11 signatures12 41 conhost.exe 26->41         started        43 PING.EXE 26->43         started        123 Uses ping.exe to sleep 33->123 45 conhost.exe 33->45         started        47 PING.EXE 1 33->47         started        49 taskkill.exe 1 35->49         started        51 conhost.exe 35->51         started        process13
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious

Private
IP
192.168.2.1
127.0.0.1

Contacted Domains

Name IP Active
bdc347c728b2d94d.com unknown unknown
84b5a35d6e5335ef.com unknown unknown
61D53B5A4BC1AB86.com unknown unknown
C431A802FF4A46B5.com unknown unknown
9ED2FEEA30C3CC5D.com unknown unknown
61d53b5a4bc1ab86.com unknown unknown
9ed2feea30c3cc5d.com unknown unknown
back19e64ea00d6ecfe1.io unknown unknown
55BE681FC6760236.com unknown unknown
BDC347C728B2D94D.com unknown unknown
84B5A35D6E5335EF.com unknown unknown
55be681fc6760236.com unknown unknown
c431a802ff4a46b5.com unknown unknown