Windows Analysis Report
SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe

Overview

General Information

Sample name: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe
Analysis ID: 1467948
MD5: d24b89cd8ed0bf45794f5f6a1324cd64
SHA1: 4218126f5f9f455af47a3c44552837357328d045
SHA256: 13b11fea340a9312543a3f33cf271bdc340daec08a03d591aa9179eb95066dcd
Tags: exe
Infos:

Detection

Score: 24
Range: 0 - 100
Whitelisted: false
Confidence: 20%

Signatures

Delayed program exit found
Writes many files with high entropy
Abnormal high CPU Usage
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to create an SMB header
Contains functionality to dynamically determine API calls
Contains functionality to launch a program with higher privileges
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes

Classification

Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008C9160 CryptAcquireContextW,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext, 0_2_008C9160
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008C9380 CryptAcquireContextW,CryptCreateHash, 0_2_008C9380
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008C93C0 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext, 0_2_008C93C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008CA360 CryptAcquireContextW,CryptCreateHash, 0_2_008CA360
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008A7620 BCryptGenRandom, 0_2_008A7620
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008C7AC0 CryptAcquireContextW,CryptCreateHash,CryptReleaseContext, 0_2_008C7AC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008C7B10 CryptHashData, 0_2_008C7B10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008C7B30 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext, 0_2_008C7B30
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BB17C0 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CryptDestroyHash,CryptReleaseContext, 10_2_00007FF674BB17C0
Contains functionality to create an SMB header
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: mov dword ptr [ebx+04h], 424D53FFh 0_2_008B3120
Uses 32bit PE files
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Users\user\AppData\Local\Temp\is-5ET6D.tmp\license.txt Jump to behavior
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Static PE information: certificate valid
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: C:\buildslave\unity\build\artifacts\UnityCrashHandler\release_win64\UnityCrashHandler64_x64.pdbE source: UnityCrashHandler64.exe, 0000000A.00000000.3354628301.00007FF674C02000.00000002.00000001.01000000.00000010.sdmp, UnityCrashHandler64.exe, 0000000A.00000002.4178682740.00007FF674C02000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: G:\Evony\Src\trunk\client\TopLoader\Release\Evony_AABBCCDDEEF.pdb source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe
Source: Binary string: C:\buildslave\unity\build\artifacts\UnityCrashHandler\release_win64\UnityCrashHandler64_x64.pdb source: UnityCrashHandler64.exe, 0000000A.00000000.3354628301.00007FF674C02000.00000002.00000001.01000000.00000010.sdmp, UnityCrashHandler64.exe, 0000000A.00000002.4178682740.00007FF674C02000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: C:\buildslave\unity\build\artifacts\WindowsPlayer\Win64_nondev_i_r\WindowsPlayer_Master_il2cpp_x64.pdb source: evony.exe, 00000009.00000000.3353467976.00007FF71C20B000.00000002.00000001.01000000.0000000D.sdmp
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BD3270 FindFirstFileW,FindNextFileW,FindClose,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 10_2_00007FF674BD3270
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BFEDE8 FindFirstFileExW, 10_2_00007FF674BFEDE8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008A6C80 socket,socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,send,recv,WSAGetLastError,closesocket,closesocket,closesocket,closesocket,closesocket, 0_2_008A6C80
Source: evony.exe, 00000009.00000003.3631074767.0000015D009FB000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.facebook.com/Evony.The.Kings.Return equals www.facebook.com (Facebook)
Source: evony.exe, 00000009.00000003.3631074767.0000015D009FB000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.facebook.com/Evony.The.Kings.Return" equals www.facebook.com (Facebook)
Source: evony.exe, 00000009.00000003.3631074767.0000015D009FB000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.facebook.com/groups/466250153910003 equals www.facebook.com (Facebook)
Source: evony.exe, 00000009.00000003.3628065439.0000015D7C416000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: 0https://www.facebook.com/Evony.The.Kings.Return/4284 equals www.facebook.com (Facebook)
Source: evony.exe, 00000009.00000003.3631074767.0000015D009FB000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: ="Facebook:\n https://www.facebook.com/Evony.The.Kings.Return" equals www.facebook.com (Facebook)
Source: evony.exe, 00000009.00000003.3628065439.0000015D7C416000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: Follow our Facebook page: <a href=https://www.facebook.com/Evony.The.Kings.Return>click here</a> to get the latest game updates, submit suggestions, and ask questions. We are here to serve you!can get."; equals www.facebook.com (Facebook)
Source: evony.exe, 00000009.00000003.3631074767.0000015D009FB000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: ["bulletin_connection_foreign04"="Group:\n https://www.facebook.com/groups/466250153910003";ghijk equals www.facebook.com (Facebook)
Source: evony.exe, 00000009.00000003.3631074767.0000015D009FB000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: ^"bulletin_connection_foreign02"="Facebook:\n https://www.facebook.com/Evony.The.Kings.Return"; equals www.facebook.com (Facebook)
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: evony.exe, 00000009.00000003.3631074767.0000015D009FB000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://changyoufun.com/wmby/index.htmlRSTU
Source: is-SG16N.tmp.6.dr String found in binary or memory: http://code.google.com/p/chromium/issues/detail?id=125863)
Source: is-SG16N.tmp.6.dr String found in binary or memory: http://code.google.com/p/chromium/issues/entry
Source: is-D6J18.tmp.6.dr String found in binary or memory: http://crbug.com/112091
Source: is-LS9UJ.tmp.6.dr String found in binary or memory: http://crbug.com/122474.
Source: is-D6J18.tmp.6.dr String found in binary or memory: http://crbug.com/235689.
Source: is-D6J18.tmp.6.dr String found in binary or memory: http://crbug.com/258526.
Source: is-D6J18.tmp.6.dr String found in binary or memory: http://crbug.com/263077).
Source: is-D6J18.tmp.6.dr String found in binary or memory: http://crbug.com/275944
Source: is-D6J18.tmp.6.dr String found in binary or memory: http://crbug.com/312900.
Source: is-D6J18.tmp.6.dr String found in binary or memory: http://crbug.com/319444.
Source: is-D6J18.tmp.6.dr String found in binary or memory: http://crbug.com/320723
Source: is-SG16N.tmp.6.dr String found in binary or memory: http://crbug.com/360567
Source: is-D6J18.tmp.6.dr String found in binary or memory: http://crbug.com/371562.
Source: is-D6J18.tmp.6.dr String found in binary or memory: http://crbug.com/378067
Source: is-LS9UJ.tmp.6.dr String found in binary or memory: http://crbug.com/415315
Source: is-LS9UJ.tmp.6.dr String found in binary or memory: http://crbug.com/415315.
Source: is-D6J18.tmp.6.dr String found in binary or memory: http://crbug.com/437891.
Source: is-D6J18.tmp.6.dr String found in binary or memory: http://crbug.com/456214
Source: is-SG16N.tmp.6.dr String found in binary or memory: http://crbug.com/469522
Source: is-D6J18.tmp.6.dr String found in binary or memory: http://crbug.com/470411
Source: is-D6J18.tmp.6.dr String found in binary or memory: http://crbug.com/473845
Source: is-D6J18.tmp.6.dr String found in binary or memory: http://crbug.com/478929
Source: is-D6J18.tmp.6.dr String found in binary or memory: http://crbug.com/510270
Source: is-D6J18.tmp.6.dr String found in binary or memory: http://crbug.com/514696
Source: is-D6J18.tmp.6.dr String found in binary or memory: http://crbug.com/516527
Source: is-D6J18.tmp.6.dr String found in binary or memory: http://crbug.com/541769
Source: is-D6J18.tmp.6.dr String found in binary or memory: http://crbug.com/642141
Source: is-D6J18.tmp.6.dr String found in binary or memory: http://crbug.com/672186).
Source: is-D6J18.tmp.6.dr String found in binary or memory: http://crbug.com/819404
Source: is-D6J18.tmp.6.dr String found in binary or memory: http://crbug.com/908458
Source: is-D6J18.tmp.6.dr String found in binary or memory: http://crbug.com/932466
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: is-D6J18.tmp.6.dr String found in binary or memory: http://developer.chrome.com/apps/usb.html#method-listInterfaces
Source: evony.exe, 00000009.00000003.3631074767.0000015D009FB000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://em.evony.com/
Source: evony_install.tmp, 00000006.00000003.2738512897.0000000003140000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://em.evony.com/PrivacyPolicy.html
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe String found in binary or memory: http://em.evony.com/down.php?type=windows&print=1
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.1703354579.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://em.evony.com/down.php?type=windows&print=15360000
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000002.2796696665.00000000009DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://em.evony.com/down.php?type=windows&print=1R_ARCHIfv
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe String found in binary or memory: http://em.evony.com/index.php?r=shorturl/getRealUrl&&k=
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000002.2796928866.0000000000A15000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.1697001253.0000000000A23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.1709596983.0000000000A15000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.1698208503.0000000000A16000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.1698267866.0000000000A23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.2796180011.00000000009FE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.1697001253.0000000000A16000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000002.2796696665.00000000009FE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.2736012055.0000000000A15000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.1703354579.0000000000A15000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://em.evony.com/index.php?r=shorturl/getRealUrl&&k=AABBCCDDEEF
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.1709596983.0000000000A15000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.1698208503.0000000000A16000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.1697001253.0000000000A16000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.2736012055.0000000000A15000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.1703354579.0000000000A15000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://em.evony.com/index.php?r=shorturl/getRealUrl&&k=AABBCCDDEEFn=0.4.0&compileType=release&n
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000002.2796928866.0000000000A15000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://em.evony.com/index.php?r=shorturl/getRealUrl&&k=AABBCCDDEEFn=0.4.0&compileType=release&nH
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe String found in binary or memory: http://em.evony.com/index.php?r=shorturl/getRealUrl&&k=http://em.evony.com/down.php?type=windows&pri
Source: evony.exe, 00000009.00000003.3631074767.0000015D009FB000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://em.evony.com/p
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe String found in binary or memory: http://emcl.evony.com
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000002.2796970628.0000000000A28000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://emcl.evony.com/pixel.jpg
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000002.2796970628.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.2736061878.0000000000A28000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://emcl.evony.com/pixel.jpg?project=EM&client=u3d&os=120&
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000002.2796970628.0000000000A28000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://emcl.evony.com/pixel.jpg?project=EM&client=u3d&os=120&.sdb
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000002.2796970628.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.2736061878.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.1709596983.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.1703354579.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.1709765092.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://emcl.evony.com/pixel.jpg?project=EM&client=u3d&os=120&ve
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000002.2796970628.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.2736061878.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.1709596983.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.1703354579.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.1709765092.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://emcl.evony.com/pixel.jpg?project=EM&client=u3d&os=120&ve%
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000002.2796970628.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.2736061878.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.1709596983.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.1709765092.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://emcl.evony.com/pixel.jpg?project=EM&client=u3d&os=120&veR
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.1703354579.0000000000A15000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000002.2796696665.00000000009DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://emcl.evony.com/pixel.jpg?project=EM&client=u3d&os=120&version=0.4.0&compileType=release&newbi
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000002.2796970628.0000000000A28000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://emcl.evony.com/pixel.jpg_
Source: evony.exe, 00000009.00000003.3628065439.0000015D7C512000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://emggcdn.ucimg.co
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.2736061878.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.1709596983.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.1709765092.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://emggcdn1.ucimg.co/client/Evony_release_b343_s298013_2024
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000002.2796970628.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.2736061878.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.1709596983.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.1709596983.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.1709765092.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://emggcdn1.ucimg.co/client/Evony_release_b343_s298013_20240628-003014_50m_windows_new_auto.exe
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000002.2796970628.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.2736061878.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.1709596983.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.1709765092.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://emggcdn1.ucimg.co/client/Evony_release_b343_s298013_20240628-003014_50m_windows_new_auto.exe.
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000002.2796970628.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.2736061878.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.1709596983.0000000000A28000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://emggcdn1.ucimg.co/client/Evony_release_b343_s298013_20240628-003014_50m_windows_new_auto.exen
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000002.2796970628.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.2736061878.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.1709596983.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe, 00000000.00000003.1709765092.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://emggcdn1.ucimg.co/client/Evony_release_b343_s298013_20240628-003014_50m_windows_new_auto.exet
Source: evony.exe, 00000009.00000003.3628065439.0000015D7C1DF000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://emggcdn1.ucimg.co/windows/UploadBundles/anim-npc-threedogs_3844115629.brotlie
Source: evony.exe, 00000009.00000003.3628065439.0000015D7C416000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://emggcdn1.ucimg.co/windows/UploadBundles/anim-puzzle_3445143400.brotlip
Source: evony.exe, 00000009.00000003.3628065439.0000015D7C416000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://emggcdn1.ucimg.co/windows/UploadBundles/anim-star_2533218360.brotli
Source: evony.exe, 00000009.00000003.3628065439.0000015D7C416000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://emggcdn1.ucimg.co/windows/UploadBundles/anim-technology_366139163.brotli
Source: evony.exe, 00000009.00000003.3628065439.0000015D7C512000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://emggcdn1.ucimg.co/windows/UploadBundles/army-anim1_147738136.brotli
Source: evony.exe, 00000009.00000003.3628065439.0000015D7C416000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://emggcdn1.ucimg.co/windows/UploadBundles/army-anim2_1335172117.brotli;;
Source: evony.exe, 00000009.00000003.3628065439.0000015D7C416000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://emggcdn1.ucimg.co/windows/UploadBundles/army-anim2_1335172117.brotlin
Source: evony.exe, 00000009.00000003.3628065439.0000015D7C416000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://emggcdn1.ucimg.co/windows/UploadBundles/army-anim3_1034175375.brotli=)
Source: evony.exe, 00000009.00000003.3628065439.0000015D7C416000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://emggcdn1.ucimg.co/windows/UploadBundles/army-anim3_1034175375.brotliia.
Source: evony.exe, 00000009.00000003.3628065439.0000015D7C416000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://emggcdn1.ucimg.co/windows/UploadBundles/army-anim4_2461290424.brotlimp
Source: evony.exe, 00000009.00000003.3628065439.0000015D7C416000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://emggcdn1.ucimg.co/windows/UploadBundles/army-anim6_3347160378.brotli
Source: evony.exe, 00000009.00000003.3628065439.0000015D7C416000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://emggcdn1.ucimg.co/windows/UploadBundles/army-ui-art_4269022620.brotlis).I
Source: evony.exe, 00000009.00000003.3628065439.0000015D7C1DF000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://emggcdn1.ucimg.co/windows/UploadBundles/prefab-building-evony5_603251547.brotli
Source: evony.exe, 00000009.00000003.3986438187.0000015D05FFD000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://emggcdn1.ucimg.co/windows/UploadBundles/prefab-ui-others_2453432180.brotli
Source: evony.exe, 00000009.00000003.3986438187.0000015D060B2000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://emggcdn1.ucimg.co/windows/UploadBundles/prefab-ui-others_2453432180.brotlip
Source: evony.exe, 00000009.00000003.3986438187.0000015D06154000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://emggcdn1.ucimg.co/windows/UploadBundles/prefab-world_3386343179.brotli
Source: evony.exe, 00000009.00000003.3986438187.0000015D06154000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://emggcdn1.ucimg.co/windows/UploadBundles/puzzle-bullhead_3362899041.brotli
Source: evony.exe, 00000009.00000003.3986438187.0000015D06154000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://emggcdn1.ucimg.co/windows/UploadBundles/puzzle-door_2747818999.brotli
Source: evony.exe, 00000009.00000003.3986438187.0000015D060B2000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://emggcdn1.ucimg.co/windows/uploadbundles/prefab-ui-others_2453432180.brotli
Source: is-D6J18.tmp.6.dr String found in binary or memory: http://foo.com/bar#NAMEDDEST.
Source: is-D6J18.tmp.6.dr, is-SG16N.tmp.6.dr String found in binary or memory: http://goo.gl/Y1OdAq
Source: evony_install.exe, 00000005.00000003.3354424021.0000000001F91000.00000004.00001000.00020000.00000000.sdmp, evony_install.exe, 00000005.00000003.2736249006.0000000001F91000.00000004.00001000.00020000.00000000.sdmp, evony_install.exe, 00000005.00000003.2736165346.0000000002200000.00000004.00001000.00020000.00000000.sdmp, evony_install.tmp, 00000006.00000003.2766148289.00000000021F8000.00000004.00001000.00020000.00000000.sdmp, evony_install.tmp, 00000006.00000003.2766166714.0000000002200000.00000004.00001000.00020000.00000000.sdmp, evony_install.tmp, 00000006.00000003.2765936915.00000000021F4000.00000004.00001000.00020000.00000000.sdmp, evony_install.tmp, 00000006.00000003.2738581379.000000000219D000.00000004.00001000.00020000.00000000.sdmp, evony_install.tmp, 00000006.00000003.2766026427.0000000002200000.00000004.00001000.00020000.00000000.sdmp, evony_install.tmp, 00000006.00000003.2766055813.00000000021F4000.00000004.00001000.00020000.00000000.sdmp, evony_install.tmp, 00000006.00000003.2766006630.00000000021F8000.00000004.00001000.00020000.00000000.sdmp, evony_install.tmp, 00000006.00000003.2766040694.0000000002204000.00000004.00001000.00020000.00000000.sdmp, evony_install.tmp, 00000006.00000003.2738512897.0000000003140000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://m.evony.com/Terms.html
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe String found in binary or memory: http://ocsp.digicert.com0
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe String found in binary or memory: http://ocsp.digicert.com0A
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe String found in binary or memory: http://ocsp.digicert.com0C
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe String found in binary or memory: http://ocsp.digicert.com0X
Source: evony_install.exe, 00000005.00000003.2737230729.0000000002200000.00000004.00001000.00020000.00000000.sdmp, evony_install.exe, 00000005.00000003.2736979042.0000000002550000.00000004.00001000.00020000.00000000.sdmp, evony_install.tmp, 00000006.00000000.2737800950.0000000000401000.00000020.00000001.01000000.00000007.sdmp String found in binary or memory: http://restools.hanzify.org/
Source: evony_install.exe, 00000005.00000003.2737230729.0000000002200000.00000004.00001000.00020000.00000000.sdmp, evony_install.exe, 00000005.00000003.2736979042.0000000002550000.00000004.00001000.00020000.00000000.sdmp, evony_install.tmp, 00000006.00000000.2737800950.0000000000401000.00000020.00000001.01000000.00000007.sdmp String found in binary or memory: http://restools.hanzify.org/U
Source: is-SG16N.tmp.6.dr String found in binary or memory: http://surveys.google.com/unit?site=z4cctguzopq5x2ftal6vdgjrui
Source: is-D6J18.tmp.6.dr String found in binary or memory: http://wiki.greasespot.net/Greasemonkey_Manual:APIs
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe String found in binary or memory: http://www.digicert.com/CPS0
Source: is-D6J18.tmp.6.dr String found in binary or memory: http://www.foo.com
Source: is-D6J18.tmp.6.dr String found in binary or memory: http://www.foo.com/bar
Source: evony_install.exe, 00000005.00000003.2737230729.0000000002200000.00000004.00001000.00020000.00000000.sdmp, evony_install.exe, 00000005.00000003.2736979042.0000000002550000.00000004.00001000.00020000.00000000.sdmp, evony_install.tmp, 00000006.00000000.2737800950.0000000000401000.00000020.00000001.01000000.00000007.sdmp String found in binary or memory: http://www.innosetup.com/
Source: is-D6J18.tmp.6.dr String found in binary or memory: http://www.json.com/json-schema-proposal/
Source: evony_install.exe, 00000005.00000003.2737230729.0000000002200000.00000004.00001000.00020000.00000000.sdmp, evony_install.exe, 00000005.00000003.2736979042.0000000002550000.00000004.00001000.00020000.00000000.sdmp, evony_install.tmp, 00000006.00000000.2737800950.0000000000401000.00000020.00000001.01000000.00000007.sdmp String found in binary or memory: http://www.remobjects.com/ps
Source: evony_install.exe, 00000005.00000003.3354370596.0000000001F98000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.wldna.com/?PreDefines.
Source: evony_install.exe, 00000005.00000003.3354370596.0000000001F98000.00000004.00001000.00020000.00000000.sdmp, evony_install.exe, 00000005.00000003.2736249006.0000000001F91000.00000004.00001000.00020000.00000000.sdmp, evony_install.exe, 00000005.00000003.2736165346.0000000002200000.00000004.00001000.00020000.00000000.sdmp, evony_install.tmp, 00000006.00000003.2738581379.000000000219D000.00000004.00001000.00020000.00000000.sdmp, evony_install.tmp, 00000006.00000003.2738512897.0000000003140000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.wldna.com/?PreDefines.ish
Source: is-D6J18.tmp.6.dr, is-SG16N.tmp.6.dr String found in binary or memory: https://accounts.google.com/
Source: is-SG16N.tmp.6.dr String found in binary or memory: https://chrome.google.com/webstore
Source: is-D6J18.tmp.6.dr String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=162042
Source: is-D6J18.tmp.6.dr String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=162044
Source: is-D6J18.tmp.6.dr String found in binary or memory: https://commondatastorage.googleapis.com/chromium-boringssl-docs/bytestring.h.html
Source: is-D6J18.tmp.6.dr String found in binary or memory: https://crbug.com/5448190).
Source: is-LS9UJ.tmp.6.dr String found in binary or memory: https://crbug.com/593166
Source: is-D6J18.tmp.6.dr String found in binary or memory: https://crbug.com/701034
Source: is-D6J18.tmp.6.dr String found in binary or memory: https://crbug.com/740629)
Source: is-LS9UJ.tmp.6.dr String found in binary or memory: https://crbug.com/787427.
Source: is-SG16N.tmp.6.dr String found in binary or memory: https://crbug.com/837107):
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe String found in binary or memory: https://curl.se/docs/alt-svc.html#
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe String found in binary or memory: https://curl.se/docs/hsts.html
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe String found in binary or memory: https://curl.se/docs/hsts.html#
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe String found in binary or memory: https://curl.se/docs/http-cookies.html#
Source: is-SG16N.tmp.6.dr String found in binary or memory: https://developer.chrome.com/devtools/docs/remote-debugging#reverse-port-forwarding
Source: is-D6J18.tmp.6.dr String found in binary or memory: https://developer.mozilla.org/en/DOM/document.
Source: is-SG16N.tmp.6.dr String found in binary or memory: https://developers.google.com/chrome-developer-tools/docs/remote-debugging
Source: evony_install.tmp, 00000006.00000003.2738512897.0000000003140000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://em.evony.com/index.php?r=shorturl/getRealUrl&k=
Source: output_log.txt.9.dr String found in binary or memory: https://emcl.evony.com/pixel.jpg?project=EM&client=u3d&os=120&isAmazon=0&hd=0&version=4.76.1.298013&
Source: evony_install.tmp, 00000006.00000003.2738512897.0000000003140000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://emcl.evony.com/pixel.jpg?project=EM&client=u3d&os=120&type=0&user_id=1020291&isAmazon=0&hd=0
Source: is-D6J18.tmp.6.dr String found in binary or memory: https://github.com/google/closure-compiler/issues/544
Source: is-D6J18.tmp.6.dr String found in binary or memory: https://github.com/v8/v8/wiki/Stack%20Trace%20API.
Source: ShareConfig.bytes.9.dr String found in binary or memory: https://m.evony.com/n1.html?content=Try_it_Yourself_Many_failed_before_Think_you_can_do_better&u=
Source: ShareConfig.bytes.9.dr String found in binary or memory: https://m.evony.com/n10.html?content=Try_it_Yourself_Many_failed_before_Think_you_can_do_better&u=
Source: ShareConfig.bytes.9.dr String found in binary or memory: https://m.evony.com/n11.html?content=Try_it_Yourself_Many_failed_before_Think_you_can_do_better&u=
Source: ShareConfig.bytes.9.dr String found in binary or memory: https://m.evony.com/n12.html?content=Try_it_Yourself_Many_failed_before_Think_you_can_do_better&u=
Source: ShareConfig.bytes.9.dr String found in binary or memory: https://m.evony.com/n13.html?content=Try_it_Yourself_Many_failed_before_Think_you_can_do_better&u=
Source: ShareConfig.bytes.9.dr String found in binary or memory: https://m.evony.com/n14.html?content=Try_it_Yourself_Many_failed_before_Think_you_can_do_better&u=
Source: ShareConfig.bytes.9.dr String found in binary or memory: https://m.evony.com/n15.html?content=Try_it_Yourself_Many_failed_before_Think_you_can_do_better&u=
Source: ShareConfig.bytes.9.dr String found in binary or memory: https://m.evony.com/n16.html?content=Try_it_Yourself_Many_failed_before_Think_you_can_do_better&u=
Source: ShareConfig.bytes.9.dr String found in binary or memory: https://m.evony.com/n17.html?content=Try_it_Yourself_Many_failed_before_Think_you_can_do_better&u=
Source: ShareConfig.bytes.9.dr String found in binary or memory: https://m.evony.com/n18.html?content=Try_it_Yourself_Many_failed_before_Think_you_can_do_better&u=
Source: ShareConfig.bytes.9.dr String found in binary or memory: https://m.evony.com/n2.html?content=Try_it_Yourself_Many_failed_before_Think_you_can_do_better&u=
Source: ShareConfig.bytes.9.dr String found in binary or memory: https://m.evony.com/n3.html?content=Try_it_Yourself_Many_failed_before_Think_you_can_do_better&u=
Source: ShareConfig.bytes.9.dr String found in binary or memory: https://m.evony.com/n4.html?content=Try_it_Yourself_Many_failed_before_Think_you_can_do_better&u=
Source: ShareConfig.bytes.9.dr String found in binary or memory: https://m.evony.com/n5.html?content=Try_it_Yourself_Many_failed_before_Think_you_can_do_better&u=
Source: ShareConfig.bytes.9.dr String found in binary or memory: https://m.evony.com/n6.html?content=Try_it_Yourself_Many_failed_before_Think_you_can_do_better&u=
Source: ShareConfig.bytes.9.dr String found in binary or memory: https://m.evony.com/n7.html?content=Try_it_Yourself_Many_failed_before_Think_you_can_do_better&u=
Source: ShareConfig.bytes.9.dr String found in binary or memory: https://m.evony.com/n8.html?content=Try_it_Yourself_Many_failed_before_Think_you_can_do_better&u=
Source: ShareConfig.bytes.9.dr String found in binary or memory: https://m.evony.com/n9.html?content=Try_it_Yourself_Many_failed_before_Think_you_can_do_better&u=
Source: ShareConfig.bytes.9.dr String found in binary or memory: https://pc.evony.com/
Source: UnityCrashHandler64.exe, 0000000A.00000000.3354628301.00007FF674C02000.00000002.00000001.01000000.00000010.sdmp, UnityCrashHandler64.exe, 0000000A.00000002.4178682740.00007FF674C02000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://perf-events.cloud.unity3d.com
Source: UnityCrashHandler64.exe, 0000000A.00000000.3354628301.00007FF674C02000.00000002.00000001.01000000.00000010.sdmp, UnityCrashHandler64.exe, 0000000A.00000002.4178682740.00007FF674C02000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://perf-events.cloud.unity3d.com--console--wait-for-debugger
Source: is-D6J18.tmp.6.dr String found in binary or memory: https://policies.google.com/privacy
Source: is-D6J18.tmp.6.dr String found in binary or memory: https://policies.google.com/terms
Source: is-SG16N.tmp.6.dr String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: is-SG16N.tmp.6.dr String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: is-D6J18.tmp.6.dr String found in binary or memory: https://support.google.com/chrome/go/feedback_confirmation
Source: is-D6J18.tmp.6.dr String found in binary or memory: https://support.google.com/legal/answer/3110420
Source: is-D6J18.tmp.6.dr String found in binary or memory: https://support.google.com/pixelbook/answer/7659411
Source: evony.exe, 00000009.00000003.3631074767.0000015D009FB000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/evony_s
Source: evony_install.exe, 00000005.00000003.3354424021.0000000001F91000.00000004.00001000.00020000.00000000.sdmp, evony_install.exe, 00000005.00000003.2736249006.0000000001F91000.00000004.00001000.00020000.00000000.sdmp, evony_install.exe, 00000005.00000003.2736165346.0000000002200000.00000004.00001000.00020000.00000000.sdmp, evony_install.tmp, 00000006.00000003.2738581379.000000000219D000.00000004.00001000.00020000.00000000.sdmp, evony_install.tmp, 00000006.00000003.2738512897.0000000003140000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.evony.com
Source: evony_install.exe, 00000005.00000003.3354424021.0000000001F91000.00000004.00001000.00020000.00000000.sdmp, evony_install.exe, 00000005.00000003.2736249006.0000000001F91000.00000004.00001000.00020000.00000000.sdmp, evony_install.tmp, 00000006.00000003.2738581379.000000000219D000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.evony.com&
Source: is-SG16N.tmp.6.dr String found in binary or memory: https://www.google.com/
Source: is-D6J18.tmp.6.dr String found in binary or memory: https://www.google.com/chrome/cleanup-tool/
Source: is-SG16N.tmp.6.dr String found in binary or memory: https://www.google.com/cloudprint
Source: is-SG16N.tmp.6.dr String found in binary or memory: https://www.google.com/cloudprint/enable_chrome_connector
Source: is-D6J18.tmp.6.dr String found in binary or memory: https://www.google.com/speech-api/v2/synthesize?
Source: is-D6J18.tmp.6.dr String found in binary or memory: https://www.gstatic.com/securitykey/a/google.com/origins.json

Spam, unwanted Advertisements and Ransom Demands
barindex
Writes many files with high entropy
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe File created: C:\Users\user\AppData\Local\Temp\evony_install.exe entropy: 7.99999435832 Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Users\user\AppData\Local\Temp\is-5ET6D.tmp\bg_welcome.png entropy: 7.9967350912 Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Users\user\AppData\Local\Temp\is-5ET6D.tmp\bg_welcome_expand.png entropy: 7.99715471715 Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Users\user\AppData\Local\Temp\is-5ET6D.tmp\bg_installing.png entropy: 7.99793861649 Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Users\user\AppData\Local\Temp\is-5ET6D.tmp\btn_setup.png entropy: 7.99016722065 Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Users\user\AppData\Local\Temp\is-5ET6D.tmp\bg_finished.png entropy: 7.99643205246 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\role-evony3-model_777875519.brotli entropy: 7.99736564882 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\role-evony1-anim_2029691946.brotli entropy: 7.99159246048 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\role-evony2-anim_2011285480.brotli entropy: 7.99123295093 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\role-evony3-anim_1520481958.brotli entropy: 7.99339972145 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\role-evony4-model_3487144469.brotli entropy: 7.99688012602 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\role-evony5-model_3315917671.brotli entropy: 7.9975866846 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\role-evony5-anim_603136724.brotli entropy: 7.99117284394 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\role-evony6-model_1593441291.brotli entropy: 7.99682253023 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\role-evony6-anim_2687762604.brotli entropy: 7.99141312028 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\role-evony7-model_2811439933.brotli entropy: 7.99708884617 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\role-evony7-anim_1650297496.brotli entropy: 7.99045869647 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\shooting_sprite_puzzle_1147677540.brotli entropy: 7.99917518298 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\building-model-out-evony5_2854177203.brotli entropy: 7.99908748088 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\building-model-in-evony5_2568264251.brotli entropy: 7.99779759976 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\anim-army-evony3-general_2835875096.brotli entropy: 7.9976743681 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\anim-army-evony4-general_3803691962.brotli entropy: 7.99811379625 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\anim-army-evony5-age1_147666316.brotli entropy: 7.99817605095 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\anim-army-evony4-age1_4004955229.brotli entropy: 7.99764390366 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\LocalLow\topgamesinc\Evony_ The King's Return\Loading\Temp\dynamic-pc-loading-l_9296308.brotli entropy: 7.99279895804 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\abtest_9501_wosmarchqueueoptimization_3505500930.brotli entropy: 7.99125074753 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\abtest_9501_marchingqueue_896672413.brotli entropy: 7.99396308252 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\e596f913526978b3de874d1d4e9fcb93.zip entropy: 7.99506256247 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\anim-army-common-age1_1377571287.brotli entropy: 7.99742467009 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\anim-army-evony1-age1_2648517498.brotli entropy: 7.99784559231 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\abtest_9351_snowstorm_1058262842.brotli entropy: 7.9994034423 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\anim-army-evony1-general_1320653600.brotli entropy: 7.99753468295 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\anim-army-evony1-age2_905865394.brotli entropy: 7.99830206772 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\anim-army-evony2-general_932571768.brotli entropy: 7.99739872434 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\anim-army-evony3-age1_252493909.brotli entropy: 7.99756830386 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\anim-army-evony5-general_2031309966.brotli entropy: 7.99729485545 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\anim-army-evony6-age1_2499610442.brotli entropy: 7.99701979734 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\anim-army-evony7-age1_2880652014.brotli entropy: 7.99786421385 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\en-US_dfbb5179cc57dd362efb6df431b2da0c.zip entropy: 7.99863982903 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\anim-boss-bimeng_1265000540.brotli entropy: 7.99902843762 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\maincity-map-evony5_3462011455.brotli entropy: 7.99946630687 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\puzzle-door_2747818999.brotli entropy: 7.9944157147 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\puzzle-egypt_4055153623.brotli entropy: 7.99746498618 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\puzzle-bullhead_3362899041.brotli entropy: 7.99759931069 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\puzzle-ad_49824091.brotli entropy: 7.99246468495 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\puzzle-map-frame_2291977699.brotli entropy: 7.99643127067 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\puzzle-nu_1965725141.brotli entropy: 7.99382960559 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\puzzle-maya_3478796074.brotli entropy: 7.99663227667 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\puzzle-original_3128651657.brotli entropy: 7.99800439671 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\puzzle-lava_754326057.brotli entropy: 7.99801090442 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\puzzle-ui_3658943333.brotli entropy: 7.99771186006 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\puzzle-map_2337640541.brotli entropy: 7.99850525469 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\puzzle-viking_1594703064.brotli entropy: 7.99736894324 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\role-evony1-model_3161167982.brotli entropy: 7.99746159625 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\puzzle-role_179201213.brotli entropy: 7.99860199097 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\role-evony2-model_3125278016.brotli entropy: 7.99773397711 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\anim-army-evony2-age1_1360540446.brotli entropy: 7.99802333627 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\prefab-anim-evony5_2974154043.brotli entropy: 7.9908846864 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\prefab-building-evony5_603251547.brotli entropy: 7.99596716253 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\city-wall-crash-evony5_3209756256.brotli entropy: 7.99784421923 Jump to dropped file
Source: C:\Program Files (x86)\Evony\evony.exe File created: C:\Users\user\AppData\Local\Temp\topgamesinc\Evony_ The King's Return\DownloadTemp\army-ui-art-evony5_3653675160.brotli entropy: 7.99625712691 Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008C9160 CryptAcquireContextW,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext, 0_2_008C9160
Abnormal high CPU Usage
Source: C:\Program Files (x86)\Evony\evony.exe Process Stats: CPU usage > 49%
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\AppData\Local\Temp\evony_install.exe Code function: 5_2_0040941C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx, 5_2_0040941C
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_0089F330 0_2_0089F330
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_0088B8C0 0_2_0088B8C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008A58F0 0_2_008A58F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008C50F0 0_2_008C50F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008D104E 0_2_008D104E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008CD150 0_2_008CD150
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008CA2C0 0_2_008CA2C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008EB4B7 0_2_008EB4B7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008B9420 0_2_008B9420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008A6500 0_2_008A6500
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008C0520 0_2_008C0520
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008E891D 0_2_008E891D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008AF910 0_2_008AF910
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008DC913 0_2_008DC913
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008C0AC0 0_2_008C0AC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008E8A41 0_2_008E8A41
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008D0BE6 0_2_008D0BE6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008D4B0F 0_2_008D4B0F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008D6B10 0_2_008D6B10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008C4B70 0_2_008C4B70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008BEC80 0_2_008BEC80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008C9CC0 0_2_008C9CC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008B4D30 0_2_008B4D30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008E6EC3 0_2_008E6EC3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008D0E1A 0_2_008D0E1A
Source: C:\Users\user\AppData\Local\Temp\evony_install.exe Code function: 5_2_004083E0 5_2_004083E0
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BCB610 10_2_00007FF674BCB610
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BFC5E4 10_2_00007FF674BFC5E4
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BFD57C 10_2_00007FF674BFD57C
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BBD563 10_2_00007FF674BBD563
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BCC570 10_2_00007FF674BCC570
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BFB6E0 10_2_00007FF674BFB6E0
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BDF6E8 10_2_00007FF674BDF6E8
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674C00800 10_2_00007FF674C00800
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BB2810 10_2_00007FF674BB2810
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BAE920 10_2_00007FF674BAE920
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BA58E0 10_2_00007FF674BA58E0
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BF58E0 10_2_00007FF674BF58E0
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BD7230 10_2_00007FF674BD7230
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BD2190 10_2_00007FF674BD2190
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BEE1A4 10_2_00007FF674BEE1A4
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BAA290 10_2_00007FF674BAA290
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BF83B0 10_2_00007FF674BF83B0
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BA4500 10_2_00007FF674BA4500
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BBD50C 10_2_00007FF674BBD50C
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BB1530 10_2_00007FF674BB1530
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BBD534 10_2_00007FF674BBD534
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674C014E0 10_2_00007FF674C014E0
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BAB490 10_2_00007FF674BAB490
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BE7D60 10_2_00007FF674BE7D60
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674C00E90 10_2_00007FF674C00E90
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BE7FCC 10_2_00007FF674BE7FCC
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BEEFB0 10_2_00007FF674BEEFB0
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BB3F60 10_2_00007FF674BB3F60
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BF010C 10_2_00007FF674BF010C
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BAE120 10_2_00007FF674BAE120
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BDC044 10_2_00007FF674BDC044
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BF1050 10_2_00007FF674BF1050
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BDD064 10_2_00007FF674BDD064
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BFB068 10_2_00007FF674BFB068
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674C009F0 10_2_00007FF674C009F0
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BD29F0 10_2_00007FF674BD29F0
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BA2980 10_2_00007FF674BA2980
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BF097C 10_2_00007FF674BF097C
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BF797C 10_2_00007FF674BF797C
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BBF990 10_2_00007FF674BBF990
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BE19A4 10_2_00007FF674BE19A4
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BAD950 10_2_00007FF674BAD950
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BE7AD0 10_2_00007FF674BE7AD0
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BF9A84 10_2_00007FF674BF9A84
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BA4AA0 10_2_00007FF674BA4AA0
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BEABBC 10_2_00007FF674BEABBC
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BA9BF0 10_2_00007FF674BA9BF0
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BBBB70 10_2_00007FF674BBBB70
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BEECC4 10_2_00007FF674BEECC4
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: String function: 008A27B0 appears 32 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: String function: 0089A540 appears 45 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: String function: 0089BC50 appears 41 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: String function: 00896CA0 appears 273 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: String function: 008CB8C0 appears 55 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: String function: 0088125B appears 43 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: String function: 00896D60 appears 214 times
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: String function: 00007FF674BA1F50 appears 85 times
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: String function: 00007FF674BACBA0 appears 59 times
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: String function: 00007FF674BDA530 appears 68 times
PE file contains executable resources (Code or Archives)
Source: evony_install.exe.0.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: evony_install.tmp.5.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: evony_install.tmp.5.dr Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: evony_install.tmp.5.dr Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: evony_install.tmp.5.dr Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: is-HULB5.tmp.6.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-HULB5.tmp.6.dr Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: is-HULB5.tmp.6.dr Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-HULB5.tmp.6.dr Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
PE file contains more sections than normal
Source: is-H800J.tmp.6.dr Static PE information: Number of sections : 14 > 10
Source: is-D23EU.tmp.6.dr Static PE information: Number of sections : 12 > 10
Uses 32bit PE files
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: _RegDLL.tmp.6.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: sus24.rans.evad.winEXE@12/1034@0/8
Source: C:\Users\user\AppData\Local\Temp\evony_install.exe Code function: 5_2_0040941C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx, 5_2_0040941C
Source: C:\Users\user\AppData\Local\Temp\evony_install.exe Code function: 5_2_00409BC0 FindResourceA,SizeofResource,LoadResource,LockResource, 5_2_00409BC0
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Program Files (x86)\Evony Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Users\Public\Desktop\Evony.lnk Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2828:120:WilError_03
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe File created: C:\Users\user\AppData\Local\Temp\evony_task.txt Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Command line argument: TopLoader 0_2_00884270
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Command line argument: TOPLOADER 0_2_00884270
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = &quot;evony.exe&quot;)
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization Jump to behavior
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe String found in binary or memory: iphlpapi.dllif_nametoindexkernel32LoadLibraryExW\/AddDllDirectoryh1h2h3%10s %512s %u %10s %512s %u "%64[^"]" %u %urt%s %s %u %s %s %u "%d%02d%02d %02d:%02d:%02d" %u %d
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Process created: C:\Users\user\AppData\Local\Temp\evony_install.exe "C:\Users\user\AppData\Local\Temp\evony_install.exe"
Source: C:\Users\user\AppData\Local\Temp\evony_install.exe Process created: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp "C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp" /SL5="$B029A,142255846,116736,C:\Users\user\AppData\Local\Temp\evony_install.exe"
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\System32\taskkill.exe" /f /im evony.exe
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Process created: C:\Program Files (x86)\Evony\evony.exe "C:\Program Files (x86)\Evony\evony.exe"
Source: C:\Program Files (x86)\Evony\evony.exe Process created: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe "C:\Program Files (x86)\Evony\UnityCrashHandler64.exe" --attach 6620 1500517896192
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Process created: C:\Users\user\AppData\Local\Temp\evony_install.exe "C:\Users\user\AppData\Local\Temp\evony_install.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\evony_install.exe Process created: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp "C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp" /SL5="$B029A,142255846,116736,C:\Users\user\AppData\Local\Temp\evony_install.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\System32\taskkill.exe" /f /im evony.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Process created: C:\Program Files (x86)\Evony\evony.exe "C:\Program Files (x86)\Evony\evony.exe" Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Process created: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe "C:\Program Files (x86)\Evony\UnityCrashHandler64.exe" --attach 6620 1500517896192 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\evony_install.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\evony_install.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: winhttpcom.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: sfc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: unityplayer.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: opengl32.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: hid.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: glu32.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: gameassembly.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: dxcore.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: mmdevapi.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: devobj.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: xinput1_3.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: xinput9_1_0.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: mscms.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: coloradapterclient.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: icm32.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Section loaded: wininet.dll
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Section loaded: version.dll
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Window found: window name: TMainForm Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Static PE information: certificate valid
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Static file information: File size 1129320 > 1048576
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\buildslave\unity\build\artifacts\UnityCrashHandler\release_win64\UnityCrashHandler64_x64.pdbE source: UnityCrashHandler64.exe, 0000000A.00000000.3354628301.00007FF674C02000.00000002.00000001.01000000.00000010.sdmp, UnityCrashHandler64.exe, 0000000A.00000002.4178682740.00007FF674C02000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: G:\Evony\Src\trunk\client\TopLoader\Release\Evony_AABBCCDDEEF.pdb source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe
Source: Binary string: C:\buildslave\unity\build\artifacts\UnityCrashHandler\release_win64\UnityCrashHandler64_x64.pdb source: UnityCrashHandler64.exe, 0000000A.00000000.3354628301.00007FF674C02000.00000002.00000001.01000000.00000010.sdmp, UnityCrashHandler64.exe, 0000000A.00000002.4178682740.00007FF674C02000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: C:\buildslave\unity\build\artifacts\WindowsPlayer\Win64_nondev_i_r\WindowsPlayer_Master_il2cpp_x64.pdb source: evony.exe, 00000009.00000000.3353467976.00007FF71C20B000.00000002.00000001.01000000.0000000D.sdmp
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_00898900 GetModuleHandleW,GetProcAddress,LoadLibraryW,GetProcAddress,LoadLibraryExW,GetSystemDirectoryW,GetSystemDirectoryW,LoadLibraryW, 0_2_00898900
PE file contains sections with non-standard names
Source: is-N3JGT.tmp.6.dr Static PE information: section name: il2cpp
Source: is-HNPT6.tmp.6.dr Static PE information: section name: .rodata
Source: is-HNPT6.tmp.6.dr Static PE information: section name: _RDATA
Source: is-D23EU.tmp.6.dr Static PE information: section name: .00cfg
Source: is-D23EU.tmp.6.dr Static PE information: section name: .crthunk
Source: is-D23EU.tmp.6.dr Static PE information: section name: .oldntma
Source: is-D23EU.tmp.6.dr Static PE information: section name: CPADinfo
Source: is-IOH65.tmp.6.dr Static PE information: section name: .00cfg
Source: is-3J5PP.tmp.6.dr Static PE information: section name: .00cfg
Source: is-H800J.tmp.6.dr Static PE information: section name: .00cfg
Source: is-H800J.tmp.6.dr Static PE information: section name: .retplne
Source: is-H800J.tmp.6.dr Static PE information: section name: .rodata
Source: is-H800J.tmp.6.dr Static PE information: section name: CPADinfo
Source: is-H800J.tmp.6.dr Static PE information: section name: prot
Source: is-H800J.tmp.6.dr Static PE information: section name: /4
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008EB223 push ecx; ret 0_2_008EB236
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008A0369 push 8B008F05h; ret 0_2_008A0374
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008CB906 push ecx; ret 0_2_008CB919
Source: C:\Users\user\AppData\Local\Temp\evony_install.exe Code function: 5_2_0040658C push 004065C9h; ret 5_2_004065C1
Source: C:\Users\user\AppData\Local\Temp\evony_install.exe Code function: 5_2_004080D8 push ecx; mov dword ptr [esp], eax 5_2_004080DD
Source: C:\Users\user\AppData\Local\Temp\evony_install.exe Code function: 5_2_00404089 push eax; ret 5_2_004040C5
Source: C:\Users\user\AppData\Local\Temp\evony_install.exe Code function: 5_2_00404159 push 00404365h; ret 5_2_0040435D
Source: C:\Users\user\AppData\Local\Temp\evony_install.exe Code function: 5_2_004041DA push 00404365h; ret 5_2_0040435D
Source: C:\Users\user\AppData\Local\Temp\evony_install.exe Code function: 5_2_00404257 push 00404365h; ret 5_2_0040435D
Source: C:\Users\user\AppData\Local\Temp\evony_install.exe Code function: 5_2_0040C218 push eax; ret 5_2_0040C219
Source: C:\Users\user\AppData\Local\Temp\evony_install.exe Code function: 5_2_004042BC push 00404365h; ret 5_2_0040435D
Source: C:\Users\user\AppData\Local\Temp\evony_install.exe Code function: 5_2_00408F0C push 00408F3Fh; ret 5_2_00408F37
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BED196 push 770004CFh; iretd 10_2_00007FF674BED19D
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Program Files (x86)\Evony\evony_Data\Plugins\ZFGameBrowser.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Program Files (x86)\Evony\UnityPlayer.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Program Files (x86)\Evony\evony_Data\Plugins\d3dcompiler_47.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Program Files (x86)\Evony\evony_Data\Plugins\is-3J5PP.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Program Files (x86)\Evony\evony.exe (copy) Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe File created: C:\Users\user\AppData\Local\Temp\evony_install.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Program Files (x86)\Evony\is-VAOIO.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Program Files (x86)\Evony\evony_Data\Plugins\is-D23EU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Program Files (x86)\Evony\is-EH7O7.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Program Files (x86)\Evony\is-MUC3P.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Users\user\AppData\Local\Temp\is-5ET6D.tmp\botva2.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Program Files (x86)\Evony\evony_Data\Plugins\is-IH2UL.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Program Files (x86)\Evony\is-PGGNK.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Program Files (x86)\Evony\GameAssembly.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Program Files (x86)\Evony\evony_Data\Plugins\is-INKGN.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Users\user\AppData\Local\Temp\is-5ET6D.tmp\_isetup\_setup64.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Program Files (x86)\Evony\evony_Data\Plugins\zf_cef.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Program Files (x86)\Evony\unins000.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Program Files (x86)\Evony\evony_Data\Plugins\libGLESv2.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\evony_install.exe File created: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Program Files (x86)\Evony\evony_Data\Plugins\ZFProxyWeb.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Program Files (x86)\Evony\is-HNPT6.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Program Files (x86)\Evony\evony_Data\Plugins\libEGL.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Users\user\AppData\Local\Temp\is-5ET6D.tmp\_isetup\_shfoldr.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Program Files (x86)\Evony\evony_Data\Plugins\is-H800J.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Users\user\AppData\Local\Temp\is-5ET6D.tmp\_isetup\_RegDLL.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Program Files (x86)\Evony\evony_Data\Plugins\is-IOH65.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Program Files (x86)\Evony\evony_Data\Plugins\chrome_elf.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Program Files (x86)\Evony\is-N3JGT.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Program Files (x86)\Evony\evony_Data\Plugins\is-NARLR.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Program Files (x86)\Evony\is-HULB5.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Users\user\AppData\Local\Temp\is-5ET6D.tmp\innocallback.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Program Files (x86)\Evony\WinPixEventRuntime.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\Users\user\AppData\Local\Temp\is-5ET6D.tmp\license.txt Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\(Default) Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\(Default)\Evony.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\(Default)\ Evony.lnk Jump to behavior
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BB2E90 GetModuleFileNameA,GetFileAttributesA,GetEnvironmentVariableA,GetFileAttributesA,LoadLibraryA,GetEnvironmentVariableA,GetFileAttributesA,LoadLibraryA,GetEnvironmentVariableA,GetFileAttributesA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetLastError,GetLastError,GetUserNameA,FreeLibrary, 10_2_00007FF674BB2E90
Source: C:\Users\user\AppData\Local\Temp\evony_install.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Process information set: NOGPFAULTERRORBOX

Malware Analysis System Evasion
barindex
Delayed program exit found
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008834F7 Sleep,ExitProcess, 0_2_008834F7
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Program Files (x86)\Evony\evony.exe Window / User API: threadDelayed 5001 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Evony\evony_Data\Plugins\ZFGameBrowser.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Evony\evony_Data\Plugins\d3dcompiler_47.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Evony\evony_Data\Plugins\is-3J5PP.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Evony\evony_Data\Plugins\is-D23EU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-5ET6D.tmp\botva2.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Evony\evony_Data\Plugins\is-IH2UL.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Evony\is-PGGNK.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Evony\evony_Data\Plugins\is-INKGN.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-5ET6D.tmp\_isetup\_setup64.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Evony\evony_Data\Plugins\zf_cef.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Evony\unins000.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Evony\evony_Data\Plugins\libGLESv2.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Evony\evony_Data\Plugins\ZFProxyWeb.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Evony\is-HNPT6.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Evony\evony_Data\Plugins\libEGL.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-5ET6D.tmp\_isetup\_shfoldr.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Evony\evony_Data\Plugins\is-H800J.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-5ET6D.tmp\_isetup\_RegDLL.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Evony\evony_Data\Plugins\chrome_elf.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Evony\evony_Data\Plugins\is-IOH65.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Evony\evony_Data\Plugins\is-NARLR.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Evony\is-N3JGT.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Evony\WinPixEventRuntime.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-5ET6D.tmp\innocallback.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Dropped PE file which has not been started: C:\Program Files (x86)\Evony\is-HULB5.tmp Jump to dropped file
Found evasive API chain (date check)
Source: C:\Users\user\AppData\Local\Temp\evony_install.exe Evasive API call chain: GetSystemTime,DecisionNodes
Found large amount of non-executed APIs
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe API coverage: 2.5 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp TID: 7432 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe TID: 1848 Thread sleep time: -50010s >= -30000s Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Program Files (x86)\Evony\evony.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Program Files (x86)\Evony\evony.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Program Files (x86)\Evony\evony.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files (x86)\Evony\evony.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BD3270 FindFirstFileW,FindNextFileW,FindClose,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 10_2_00007FF674BD3270
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BFEDE8 FindFirstFileExW, 10_2_00007FF674BFEDE8
Source: C:\Users\user\AppData\Local\Temp\evony_install.exe Code function: 5_2_00409B04 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery, 5_2_00409B04
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Process information queried: ProcessInformation Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008CB6D6 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_008CB6D6
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_00898900 GetModuleHandleW,GetProcAddress,LoadLibraryW,GetProcAddress,LoadLibraryExW,GetSystemDirectoryW,GetSystemDirectoryW,LoadLibraryW, 0_2_00898900
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008E2F9A mov eax, dword ptr fs:[00000030h] 0_2_008E2F9A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008DB588 mov eax, dword ptr fs:[00000030h] 0_2_008DB588
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008E2FE0 mov eax, dword ptr fs:[00000030h] 0_2_008E2FE0
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BF96A8 GetProcessHeap, 10_2_00007FF674BF96A8
Enables debug privileges
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008CB6D6 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_008CB6D6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008CB869 SetUnhandledExceptionFilter, 0_2_008CB869
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008CE9EE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_008CE9EE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008CAC9A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_008CAC9A
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BDF8C0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 10_2_00007FF674BDF8C0
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674C002A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 10_2_00007FF674C002A0
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BE994C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 10_2_00007FF674BE994C
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BDFA9C SetUnhandledExceptionFilter, 10_2_00007FF674BDFA9C
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_00883339 ShellExecuteW,ShellExecuteW,Sleep,ShellExecuteW,Sleep,ShellExecuteW, 0_2_00883339
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\System32\taskkill.exe" /f /im evony.exe Jump to behavior
Source: C:\Program Files (x86)\Evony\evony.exe Process created: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe "C:\Program Files (x86)\Evony\UnityCrashHandler64.exe" --attach 6620 1500517896192 Jump to behavior
Uses taskkill to terminate processes
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\System32\taskkill.exe" /f /im evony.exe Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008CB52F cpuid 0_2_008CB52F
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\AppData\Local\Temp\evony_install.exe Code function: GetLocaleInfoA, 5_2_004051D0
Source: C:\Users\user\AppData\Local\Temp\evony_install.exe Code function: GetLocaleInfoA, 5_2_0040521C
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,wcschr,wcschr,GetLocaleInfoW, 10_2_00007FF674BFB6E0
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: try_get_function,GetLocaleInfoW, 10_2_00007FF674BF375C
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: EnumSystemLocalesW, 10_2_00007FF674BF32CC
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: GetLocaleInfoW, 10_2_00007FF674BFBDF0
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: GetLocaleInfoW, 10_2_00007FF674BFBFF8
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 10_2_00007FF674BFBF48
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 10_2_00007FF674BFC124
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: EnumSystemLocalesW, 10_2_00007FF674BFBB10
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: EnumSystemLocalesW, 10_2_00007FF674BFBA40
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 10_2_00007FF674BFBBA8
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Program Files (x86)\Evony\evony.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Queries volume information: C:\Users\user\AppData\Local\Temp\is-5ET6D.tmp\btn_setup.png VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Queries volume information: C:\Users\user\AppData\Local\Temp\is-5ET6D.tmp\btn_customize.png VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Queries volume information: C:\Users\user\AppData\Local\Temp\is-5ET6D.tmp\btn_browser.png VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Queries volume information: C:\Users\user\AppData\Local\Temp\is-5ET6D.tmp\bg_welcome.png VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Queries volume information: C:\Users\user\AppData\Local\Temp\is-5ET6D.tmp\checkbox.png VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Queries volume information: C:\Users\user\AppData\Local\Temp\is-5ET6D.tmp\label_read.png VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Queries volume information: C:\Users\user\AppData\Local\Temp\is-5ET6D.tmp\label_license.png VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Queries volume information: C:\Users\user\AppData\Local\Temp\is-5ET6D.tmp\label_privacy.png VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Queries volume information: C:\Users\user\AppData\Local\Temp\is-5ET6D.tmp\bg_installing.png VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Queries volume information: C:\Users\user\AppData\Local\Temp\is-5ET6D.tmp\loading.png VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Queries volume information: C:\Users\user\AppData\Local\Temp\is-5ET6D.tmp\btn_complete.png VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Queries volume information: C:\Users\user\AppData\Local\Temp\is-5ET6D.tmp\bg_finished.png VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TKDSD.tmp\evony_install.tmp Queries volume information: C:\Users\user\AppData\Local\Temp\is-5ET6D.tmp\label_autorun.png VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008E1265 GetSystemTimeAsFileTime, 0_2_008E1265
Source: C:\Program Files (x86)\Evony\UnityCrashHandler64.exe Code function: 10_2_00007FF674BB2E90 GetModuleFileNameA,GetFileAttributesA,GetEnvironmentVariableA,GetFileAttributesA,LoadLibraryA,GetEnvironmentVariableA,GetFileAttributesA,LoadLibraryA,GetEnvironmentVariableA,GetFileAttributesA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetLastError,GetLastError,GetUserNameA,FreeLibrary, 10_2_00007FF674BB2E90
Source: C:\Users\user\AppData\Local\Temp\evony_install.exe Code function: 5_2_00405CB8 GetVersionExA, 5_2_00405CB8
Source: C:\Program Files (x86)\Evony\evony.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008A6C80 socket,socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,send,recv,WSAGetLastError,closesocket,closesocket,closesocket,closesocket,closesocket, 0_2_008A6C80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008BD4B0 ___from_strstr_to_strchr,htons,htons,htons,htons,bind,htons,htons,bind,getsockname,WSAGetLastError,WSAGetLastError, 0_2_008BD4B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008B6730 bind,WSAGetLastError, 0_2_008B6730
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe Code function: 0_2_008AF910 ___from_strstr_to_strchr,_strncpy,___from_strstr_to_strchr,_strncpy,___from_strstr_to_strchr,___from_strstr_to_strchr,getsockname,WSAGetLastError,WSAGetLastError,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,getsockname,WSAGetLastError,listen,WSAGetLastError,htons,htons,___swprintf_l,___swprintf_l,___swprintf_l, 0_2_008AF910
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1467948 Sample: SecuriteInfo.com.Trojan.Sig... Startdate: 05/07/2024 Architecture: WINDOWS Score: 24 63 Writes many files with high entropy 2->63 9 SecuriteInfo.com.Trojan.Siggen20.45289.27589.26669.exe 4 5 2->9         started        process3 dnsIp4 57 34.110.215.133 GOOGLEUS United States 9->57 59 38.45.227.13 COGENT-174US United States 9->59 61 2 other IPs or domains 9->61 47 C:\Users\user\AppData\...\evony_install.exe, PE32 9->47 dropped 67 Writes many files with high entropy 9->67 69 Delayed program exit found 9->69 14 evony_install.exe 2 9->14         started        file5 signatures6 process7 file8 49 C:\Users\user\AppData\...\evony_install.tmp, PE32 14->49 dropped 17 evony_install.tmp 28 202 14->17         started        process9 file10 31 C:\Program Files (x86)\...\evony.exe (copy), PE32+ 17->31 dropped 33 C:\Users\user\AppData\Local\...\btn_setup.png, PNG 17->33 dropped 35 C:\Users\user\...\bg_welcome_expand.png, PNG 17->35 dropped 37 34 other files (3 malicious) 17->37 dropped 65 Writes many files with high entropy 17->65 21 evony.exe 28 693 17->21         started        25 taskkill.exe 1 17->25         started        signatures11 process12 dnsIp13 51 34.107.172.168 GOOGLEUS United States 21->51 53 34.111.113.40 GOOGLEUS United States 21->53 55 2 other IPs or domains 21->55 39 shooting_sprite_puzzle_1147677540.brotli, data 21->39 dropped 41 C:\...\role-evony7-model_2811439933.brotli, data 21->41 dropped 43 C:\...\role-evony7-anim_1650297496.brotli, data 21->43 dropped 45 52 other malicious files 21->45 dropped 27 UnityCrashHandler64.exe 21->27         started        29 conhost.exe 25->29         started        file14 process15
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
38.45.227.13
 unknown United States
174 COGENT-174US false
38.45.227.5
 unknown United States
174 COGENT-174US false
38.45.227.6
 unknown United States
174 COGENT-174US false
34.107.172.168
 unknown United States
15169 GOOGLEUS false
34.110.215.133
 unknown United States
15169 GOOGLEUS false
76.9.213.8
 unknown Canada
21949 BEANFIELDCA false
34.111.113.40
 unknown United States
15169 GOOGLEUS false

Private

IP
127.0.0.1