Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\system\systemcheck
Modifies file system
Creates the following files
- %TEMP%\aut4e36.tmp
- %TEMP%\_mei14362\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei14362\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei14362\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei14362\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei14362\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei14362\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei14362\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei14362\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei14362\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei14362\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei14362\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei14362\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei14362\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei14362\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei14362\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei14362\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei14362\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei14362\win32api.pyd
- %TEMP%\_mei14362\unicodedata.pyd
- %TEMP%\_mei14362\ucrtbase.dll
- %TEMP%\_mei14362\select.pyd
- %TEMP%\_mei14362\pywintypes37.dll
- %TEMP%\_mei14362\python37.dll
- %TEMP%\_mei14362\libssl-1_1-x64.dll
- %TEMP%\_mei14362\pyexpat.pyd
- %TEMP%\_mei14362\libcrypto-1_1-x64.dll
- %TEMP%\_mei14362\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei14362\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei14362\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei14362\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei14362\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei14362\win32evtlog.pyd
- %TEMP%\_mei14362\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei14362\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei14362\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\asacpiex.dll
- %TEMP%\cr_debug_log.txt
- %TEMP%\aut898b.tmp
- %TEMP%\cl_debug_log.txt
- %TEMP%\aut8b70.tmp
- %TEMP%\1.exe
- %TEMP%\32.exe
- %TEMP%\64.exe
- %TEMP%\systemcheck.xml
- %APPDATA%\microsoft\windows\helper.exe
- %TEMP%\_mei14362\steam_keys_generator.exe.manifest
- %TEMP%\_mei14362\vcruntime140.dll
- %TEMP%\_mei14362\_bz2.pyd
- %TEMP%\_mei14362\_ctypes.pyd
- %TEMP%\_mei14362\_hashlib.pyd
- %TEMP%\_mei14362\_lzma.pyd
- %TEMP%\_mei14362\_queue.pyd
- %TEMP%\_mei14362\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei14362\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei14362\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei14362\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei14362\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei14362\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei14362\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei14362\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei14362\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei14362\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei14362\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei14362\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei14362\_ssl.pyd
- %TEMP%\_mei14362\_socket.pyd
- %TEMP%\_mei14362\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei14362\base_library.zip
Deletes the following files
- %TEMP%\aut4e36.tmp
- %TEMP%\aut898b.tmp
- %TEMP%\aut8b70.tmp
- %TEMP%\systemcheck.xml
- %TEMP%\32.exe
- %TEMP%\64.exe
- %TEMP%\cl_debug_log.txt
- %TEMP%\cr_debug_log.txt
- %TEMP%\asacpiex.dll
Network activity
TCP
- '2n#.co':443
UDP
- DNS ASK 2n#.co
Miscellaneous
Creates and executes the following
- '%TEMP%\cl_debug_log.txt' e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "%TEMP%\CR_Debug_Log.txt" -o"%TEMP%\"
- '%TEMP%\1.exe'
- '%TEMP%\cl_debug_log.txt' e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "%TEMP%\CR_Debug_Log.txt" -o"%TEMP%\"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c schtasks.exe /Create /XML "%TEMP%\SystemCheck.xml" /TN "System\SystemCheck"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "cls"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c schtasks.exe /Create /XML "%TEMP%\SystemCheck.xml" /TN "System\SystemCheck"
- '%WINDIR%\syswow64\schtasks.exe' /Create /XML "%TEMP%\SystemCheck.xml" /TN "System\SystemCheck"
- '<SYSTEM32>\cmd.exe' /c "cls"
