Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'windows0x64' = '%APPDATA%\Microsoft\windows0x64\svchost.vbs'
- %TEMP%\cea1.tmp\cea2.tmp\cea3.bat
- %TEMP%\_mei21402\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei21402\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei21402\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei21402\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei21402\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei21402\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei21402\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei21402\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei21402\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei21402\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei21402\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei21402\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei21402\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei21402\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei21402\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei21402\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei21402\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei21402\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei21402\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei21402\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei21402\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei21402\unicodedata.pyd
- %TEMP%\_mei21402\ucrtbase.dll
- %TEMP%\_mei21402\select.pyd
- %TEMP%\_mei21402\python37.dll
- %TEMP%\_mei21402\pyexpat.pyd
- %TEMP%\_mei21402\libssl-1_1-x64.dll
- %TEMP%\_mei21402\libcrypto-1_1-x64.dll
- %TEMP%\_mei21402\hellminer.exe.manifest
- %TEMP%\_mei21402\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei21402\_lzma.pyd
- %TEMP%\_mei21402\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei21402\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei21402\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei21402\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei21402\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei21402\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei21402\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei21402\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei21402\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei21402\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei21402\api-ms-win-core-file-l1-1-0.dll
- %APPDATA%\microsoft\windows0x64\setup.bat
- %APPDATA%\microsoft\windows0x64\run.bat
- %APPDATA%\microsoft\windows0x64\install.vbs
- %APPDATA%\microsoft\windows0x64\install.bat
- %APPDATA%\microsoft\windows0x64\check.bat
- %TEMP%\cea1.tmp\windows0x64.exe
- %TEMP%\cea1.tmp\verus-solver.exe
- %TEMP%\cea1.tmp\windows0x64.bat
- %TEMP%\cea1.tmp\update.vbs
- %TEMP%\cea1.tmp\svchost.vbs
- %TEMP%\cea1.tmp\start.vbs
- %TEMP%\cea1.tmp\setup.bat
- %TEMP%\cea1.tmp\run.bat
- %TEMP%\cea1.tmp\install.vbs
- %TEMP%\cea1.tmp\install.bat
- %TEMP%\cea1.tmp\check.bat
- %APPDATA%\microsoft\windows0x64\svchost.vbs
- %APPDATA%\microsoft\windows0x64\update.vbs
- %APPDATA%\microsoft\windows0x64\start.vbs
- %APPDATA%\microsoft\windows0x64\verus-solver.exe
- %TEMP%\_mei21402\api-ms-win-core-errorhandling-l1-1-0.dll
- %APPDATA%\microsoft\windows0x64\windows0x64.bat
- %TEMP%\_mei21402\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei21402\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei21402\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei21402\_ssl.pyd
- %TEMP%\_mei21402\_socket.pyd
- %TEMP%\_mei21402\_queue.pyd
- %TEMP%\_mei21402\_overlapped.pyd
- %TEMP%\_mei21402\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei21402\base_library.zip
- %TEMP%\_mei21402\_hashlib.pyd
- %TEMP%\_mei21402\_decimal.pyd
- %TEMP%\_mei21402\_ctypes.pyd
- %TEMP%\_mei21402\_contextvars.pyd
- %TEMP%\_mei21402\_bz2.pyd
- %TEMP%\_mei21402\_asyncio.pyd
- %TEMP%\_mei21402\vcruntime140.dll
- %APPDATA%\microsoft\windows0x64\windows0x64.exe
- %TEMP%\_mei21402\_multiprocessing.pyd
- %TEMP%\62_7hdib
- %TEMP%\cea1.tmp\cea2.tmp\cea3.bat
- %TEMP%\cea1.tmp\check.bat
- %TEMP%\cea1.tmp\install.bat
- %TEMP%\cea1.tmp\install.vbs
- %TEMP%\cea1.tmp\run.bat
- %TEMP%\cea1.tmp\start.vbs
- %TEMP%\cea1.tmp\svchost.vbs
- %TEMP%\cea1.tmp\update.vbs
- %TEMP%\cea1.tmp\verus-solver.exe
- %TEMP%\cea1.tmp\windows0x64.bat
- %TEMP%\cea1.tmp\windows0x64.exe
- %TEMP%\62_7hdib
- '13#.#9.123.225':3956
- '<SYSTEM32>\wscript.exe' "%TEMP%\CEA1.tmp\install.vbs"
- '<SYSTEM32>\wscript.exe' "%APPDATA%\Microsoft\windows0x64\svchost.vbs"
- '<SYSTEM32>\wscript.exe' "%APPDATA%\Microsoft\windows0x64\start.vbs"
- '%APPDATA%\microsoft\windows0x64\windows0x64.exe' -c stratum+tcp://ap.luckpool.net:3956#xnsub -u RRdTxn5aKZUt1pEfyHYver7C3WWvhNHpHa.jaipur -p x --cpu 1
- '%APPDATA%\microsoft\windows0x64\verus-solver.exe' -verus2 --cpu 0
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\CEA1.tmp\CEA2.tmp\CEA3.bat <Full path to file>"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\CEA1.tmp\setup.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\CEA1.tmp\install.bat" "' (with hidden window)
- '<SYSTEM32>\wscript.exe' "%APPDATA%\Microsoft\windows0x64\start.vbs"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%APPDATA%\Microsoft\windows0x64\windows0x64.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%APPDATA%\Microsoft\windows0x64\check.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\CEA1.tmp\windows0x64.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\CEA1.tmp\check.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\CEA1.tmp\CEA2.tmp\CEA3.bat <Full path to file>"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\CEA1.tmp\setup.bat" "
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\CEA1.tmp\install.bat" "
- '<SYSTEM32>\reg.exe' ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "windows0x64" /t REG_SZ /d ""%APPDATA%"\Microsoft\windows0x64\svchost.vbs" /f
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "%HOMEPATH%\AppData"
- '<SYSTEM32>\cmd.exe' /c ""%APPDATA%\Microsoft\windows0x64\windows0x64.bat" "
- '<SYSTEM32>\cmd.exe' /c ""%APPDATA%\Microsoft\windows0x64\check.bat" "
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\CEA1.tmp\windows0x64.bat" "
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\CEA1.tmp\check.bat" "
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq Taskmgr.exe"
- '<SYSTEM32>\find.exe' /I /N "Taskmgr.exe"