Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\flash service support
- <SYSTEM32>\tasks\flash_installer
Modifies file system
Creates the following files
- %TEMP%\_mei12602\vcruntime140.dll
- %TEMP%\_mei23162\python37.dll
- %TEMP%\_mei23162\python3.dll
- %TEMP%\_mei23162\pyexpat.pyd
- %TEMP%\_mei23162\mfc140u.dll
- %TEMP%\_mei23162\main.exe.manifest
- %TEMP%\_mei23162\libssl-1_1.dll
- %TEMP%\_mei23162\libcrypto-1_1.dll
- %TEMP%\_mei23162\cryptography\hazmat\bindings\_openssl.pyd
- %TEMP%\_mei23162\pythoncom37.dll
- %TEMP%\_mei23162\_win32sysloader.pyd
- %TEMP%\_mei23162\_socket.pyd
- %TEMP%\_mei23162\_queue.pyd
- %TEMP%\_mei23162\_pytransform.dll
- %TEMP%\_mei23162\_lzma.pyd
- %TEMP%\_mei23162\_hashlib.pyd
- %TEMP%\_mei23162\_decimal.pyd
- %TEMP%\_mei23162\_ctypes.pyd
- %TEMP%\_mei23162\_cffi_backend.cp37-win32.pyd
- %TEMP%\_mei23162\_ssl.pyd
- %TEMP%\_mei23162\pywintypes37.dll
- %TEMP%\_mei23162\select.pyd
- %TEMP%\_mei23162\unicodedata.pyd
- %TEMP%\tmpmncz53wr\gen_py\dicts.dat
- %TEMP%\tmpmncz53wr\gen_py\__init__.py
- %TEMP%\23h1erub
- %TEMP%\_mei23162\cryptography-3.2.1-py3.7.egg-info\top_level.txt
- %TEMP%\_mei23162\cryptography-3.2.1-py3.7.egg-info\wheel
- %TEMP%\_mei23162\cryptography-3.2.1-py3.7.egg-info\record
- %TEMP%\_mei23162\cryptography-3.2.1-py3.7.egg-info\metadata
- %TEMP%\_mei23162\cryptography-3.2.1-py3.7.egg-info\license.psf
- %TEMP%\_mei23162\cryptography-3.2.1-py3.7.egg-info\license.bsd
- %TEMP%\_mei23162\cryptography-3.2.1-py3.7.egg-info\license.apache
- %TEMP%\_mei23162\cryptography-3.2.1-py3.7.egg-info\license
- %TEMP%\_mei23162\cryptography-3.2.1-py3.7.egg-info\installer
- %TEMP%\_mei23162\cryptography-3.2.1-py3.7.egg-info\authors.rst
- %TEMP%\_mei23162\certifi\cacert.pem
- %TEMP%\_mei23162\base_library.zip
- %TEMP%\_mei23162\include\pyconfig.h
- %TEMP%\_mei23162\win32ui.pyd
- %TEMP%\_mei23162\win32trace.pyd
- %TEMP%\_mei23162\win32api.pyd
- %TEMP%\_mei23162\_bz2.pyd
- %TEMP%\bpyc.pid
- %TEMP%\_mei23162\vcruntime140.dll
- %TEMP%\tmpolftmqgo\gen_py\dicts.dat
- %TEMP%\_mei12602\python3.dll
- %TEMP%\_mei12602\pyexpat.pyd
- %TEMP%\_mei12602\mfc140u.dll
- %TEMP%\_mei12602\main.exe.manifest
- %TEMP%\_mei12602\libssl-1_1.dll
- %TEMP%\_mei12602\libcrypto-1_1.dll
- %TEMP%\_mei12602\cryptography\hazmat\bindings\_openssl.pyd
- %TEMP%\_mei12602\_win32sysloader.pyd
- %TEMP%\_mei12602\python37.dll
- %TEMP%\_mei12602\_ssl.pyd
- %TEMP%\_mei12602\_queue.pyd
- %TEMP%\_mei12602\_pytransform.dll
- %TEMP%\_mei12602\_lzma.pyd
- %TEMP%\_mei12602\_hashlib.pyd
- %TEMP%\_mei12602\_decimal.pyd
- %TEMP%\_mei12602\_ctypes.pyd
- %TEMP%\_mei12602\_cffi_backend.cp37-win32.pyd
- %TEMP%\_mei12602\_bz2.pyd
- %TEMP%\_mei12602\_socket.pyd
- %TEMP%\_mei12602\pythoncom37.dll
- %TEMP%\_mei12602\pywintypes37.dll
- %TEMP%\_mei12602\select.pyd
- %TEMP%\tmpolftmqgo\gen_py\__init__.py
- %TEMP%\z39ij7d2
- %TEMP%\_mei12602\cryptography-3.2.1-py3.7.egg-info\top_level.txt
- %TEMP%\_mei12602\cryptography-3.2.1-py3.7.egg-info\wheel
- %TEMP%\_mei12602\cryptography-3.2.1-py3.7.egg-info\record
- %TEMP%\_mei12602\cryptography-3.2.1-py3.7.egg-info\metadata
- %TEMP%\_mei12602\cryptography-3.2.1-py3.7.egg-info\license.psf
- %TEMP%\_mei12602\cryptography-3.2.1-py3.7.egg-info\license.bsd
- %TEMP%\_mei12602\cryptography-3.2.1-py3.7.egg-info\license.apache
- %TEMP%\_mei12602\cryptography-3.2.1-py3.7.egg-info\license
- %TEMP%\_mei12602\cryptography-3.2.1-py3.7.egg-info\installer
- %TEMP%\_mei12602\cryptography-3.2.1-py3.7.egg-info\authors.rst
- %TEMP%\_mei12602\certifi\cacert.pem
- %TEMP%\_mei12602\base_library.zip
- %TEMP%\_mei12602\include\pyconfig.h
- %TEMP%\_mei12602\win32ui.pyd
- %TEMP%\_mei12602\win32trace.pyd
- %TEMP%\_mei12602\win32api.pyd
- %TEMP%\_mei12602\unicodedata.pyd
- C:\users\public\bpyc\fservice.exe
- %TEMP%\flash_1607210772.7992.exe
Deletes the following files
- %TEMP%\z39ij7d2
- %TEMP%\_mei12602\python3.dll
- %TEMP%\_mei12602\python37.dll
- %TEMP%\_mei12602\pythoncom37.dll
- %TEMP%\_mei12602\pywintypes37.dll
- %TEMP%\_mei12602\select.pyd
- %TEMP%\_mei12602\unicodedata.pyd
- %TEMP%\_mei12602\vcruntime140.dll
- %TEMP%\_mei12602\win32api.pyd
- %TEMP%\_mei12602\win32trace.pyd
- %TEMP%\_mei12602\win32ui.pyd
- %TEMP%\_mei12602\_bz2.pyd
- %TEMP%\_mei12602\_cffi_backend.cp37-win32.pyd
- %TEMP%\_mei12602\_ctypes.pyd
- %TEMP%\_mei12602\_decimal.pyd
- %TEMP%\_mei12602\_hashlib.pyd
- %TEMP%\_mei12602\_lzma.pyd
- %TEMP%\_mei12602\_pytransform.dll
- %TEMP%\_mei12602\_queue.pyd
- %TEMP%\_mei12602\_socket.pyd
- %TEMP%\_mei12602\pyexpat.pyd
- %TEMP%\_mei12602\_ssl.pyd
- %TEMP%\_mei12602\mfc140u.dll
- %TEMP%\_mei12602\libssl-1_1.dll
- %TEMP%\23h1erub
- <SYSTEM32>\tasks\flash_installer
- %TEMP%\tmpolftmqgo\gen_py\dicts.dat
- %TEMP%\tmpolftmqgo\gen_py\__init__.py
- %TEMP%\_mei12602\base_library.zip
- %TEMP%\_mei12602\certifi\cacert.pem
- %TEMP%\_mei12602\cryptography\hazmat\bindings\_openssl.pyd
- %TEMP%\_mei12602\cryptography-3.2.1-py3.7.egg-info\authors.rst
- %TEMP%\_mei12602\cryptography-3.2.1-py3.7.egg-info\installer
- %TEMP%\_mei12602\cryptography-3.2.1-py3.7.egg-info\license
- %TEMP%\_mei12602\cryptography-3.2.1-py3.7.egg-info\license.apache
- %TEMP%\_mei12602\cryptography-3.2.1-py3.7.egg-info\license.bsd
- %TEMP%\_mei12602\cryptography-3.2.1-py3.7.egg-info\license.psf
- %TEMP%\_mei12602\cryptography-3.2.1-py3.7.egg-info\metadata
- %TEMP%\_mei12602\cryptography-3.2.1-py3.7.egg-info\record
- %TEMP%\_mei12602\cryptography-3.2.1-py3.7.egg-info\top_level.txt
- %TEMP%\_mei12602\cryptography-3.2.1-py3.7.egg-info\wheel
- %TEMP%\_mei12602\include\pyconfig.h
- %TEMP%\_mei12602\libcrypto-1_1.dll
- %TEMP%\_mei12602\main.exe.manifest
- %TEMP%\_mei12602\_win32sysloader.pyd
Network activity
TCP
- 'fl##h.cn':443
UDP
- DNS ASK fl##h.cn
Miscellaneous
Creates and executes the following
- 'C:\users\public\bpyc\fservice.exe' frominstall
- 'C:\users\public\bpyc\fservice.exe' frominstall' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c SCHTASKS /Run /TN "Flash_Installer"
- '%WINDIR%\syswow64\schtasks.exe' /Run /TN "Flash_Installer"
- '<SYSTEM32>\taskeng.exe' {DDE182B9-F12A-4AEF-A3C7-BA2371FD27BA} S-1-5-21-1960123792-2022915161-3775307078-1001:pizvifln\user:Interactive:[1]
- '%WINDIR%\syswow64\cmd.exe' /c SCHTASKS /Delete /F /TN Flash_Installer
- '%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN Flash_Installer
