Technical Information
Modifies file system
Creates the following files
- <Current directory>\fv2xsonicxtrainer2021\farmville_2_xsonicx_new_codes2.txt
- <Current directory>\fv2xsonicxtrainer2021\fv2-xsonicx(windows 32bits).exe
- <Current directory>\fv2xsonicxtrainer2021\fv2-xsonicx(windows 64bits).exe
- <Current directory>\fv2xsonicxtrainer2021\fv2-xsonicx.xsonicx
- <Current directory>\fv2xsonicxtrainer2021\lua53-32.dll
- <Current directory>\fv2xsonicxtrainer2021\lua53-64.dll
- C:\users\public\desktop\fv2xsonicxtrainer2021_32b.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\fv2xsonicxtrainer2021_32b.lnk
- C:\users\public\desktop\fv2xsonicxtrainer2021_64b.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\fv2xsonicxtrainer2021_64b.lnk
- %TEMP%\7zsfx000.cmd
- %ALLUSERSPROFILE%\uid.txt
Deletes the following files
- %TEMP%\7zsfx000.cmd
- <Current directory>\fv2xsonicxtrainer2021\downloadfail.xsonicx
Moves the following files
- from <Current directory>\fv2xsonicxtrainer2021\fv2-xsonicx.xsonicx to <Current directory>\fv2xsonicxtrainer2021\downloadfail.xsonicx
Modifies the following files
Substitutes the following files
- <Current directory>\fv2xsonicxtrainer2021\fv2-xsonicx.xsonicx
Deletes itself.
Network activity
Connects to
- 'mi###pla.com':80
- 'cl#.pt':443
- 'microsoft.com':80
- 'fv#########ytrainer.mygamesonline.org':80
- 'pa###bin.com':80
- 'pa###bin.com':443
- 'fa###ook.com':443
- 'st####.xx.fbcdn.net':443
- 'fb##x.com':443
TCP
Other
- 'cl#.pt':443
- 'pa###bin.com':443
- 'fa###ook.com':443
- 'st####.xx.fbcdn.net':443
UDP
- DNS ASK mi###pla.com
- DNS ASK cl#.pt
- DNS ASK microsoft.com
- DNS ASK fv#########ytrainer.mygamesonline.org
- DNS ASK pa###bin.com
- DNS ASK fa###ook.com
- DNS ASK m.###ebook.com
- DNS ASK st####.xx.fbcdn.net
- DNS ASK fb##n.net
- DNS ASK fb##x.com
Miscellaneous
Searches for the following windows
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '<Current directory>\fv2xsonicxtrainer2021\fv2-xsonicx(windows 64bits).exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZSfx000.cmd" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZSfx000.cmd" "
- '<SYSTEM32>\cmd.exe' /c wmic nic where (netConnectionStatus=2) get MACAddress
- '<SYSTEM32>\wbem\wmic.exe' nic where (netConnectionStatus=2) get MACAddress
- '<SYSTEM32>\cmd.exe' /c wmic csproduct get uuid
- '<SYSTEM32>\wbem\wmic.exe' csproduct get uuid
