Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /IM LocMt2.exe
Modifies file system
Creates the following files
- %TEMP%\_mei27482\pyqt5\qt5\bin\msvcp140.dll
- %TEMP%\_mei27482\pyqt5\qt5\bin\msvcp140_1.dll
- %TEMP%\_mei27482\pyqt5\qt5\bin\qt5core.dll
- %TEMP%\_mei27482\pyqt5\qt5\bin\qt5dbus.dll
- %TEMP%\_mei27482\pyqt5\qt5\bin\qt5gui.dll
- %TEMP%\_mei27482\pyqt5\qt5\bin\qt5network.dll
- %TEMP%\_mei27482\pyqt5\qt5\bin\qt5qml.dll
- %TEMP%\_mei27482\pyqt5\qt5\bin\qt5qmlmodels.dll
- %TEMP%\_mei27482\pyqt5\qt5\bin\qt5quick.dll
- %TEMP%\_mei27482\pyqt5\qt5\bin\qt5svg.dll
- %TEMP%\_mei27482\pyqt5\qt5\bin\qt5websockets.dll
- %TEMP%\_mei27482\pyqt5\qt5\bin\qt5widgets.dll
- %TEMP%\_mei27482\pyqt5\qt5\bin\vcruntime140.dll
- %TEMP%\_mei27482\pyqt5\qt5\bin\d3dcompiler_47.dll
- %TEMP%\_mei27482\pyqt5\qt5\bin\libegl.dll
- %TEMP%\_mei27482\pyqt5\qt5\bin\libglesv2.dll
- %TEMP%\_mei27482\pyqt5\qt5\bin\opengl32sw.dll
- %TEMP%\_mei27482\pyqt5\qt5\plugins\generic\qtuiotouchplugin.dll
- %TEMP%\_mei27482\pyqt5\qt5\plugins\iconengines\qsvgicon.dll
- %TEMP%\_mei27482\pyqt5\qt5\plugins\imageformats\qgif.dll
- %TEMP%\_mei27482\pyqt5\qt5\plugins\imageformats\qicns.dll
- %TEMP%\_mei27482\pyqt5\qt5\plugins\imageformats\qico.dll
- %TEMP%\_mei27482\pyqt5\qt5\plugins\imageformats\qjpeg.dll
- %TEMP%\_mei27482\pyqt5\qt5\plugins\imageformats\qsvg.dll
- %TEMP%\_mei27482\pyqt5\qt5\plugins\imageformats\qtga.dll
- %TEMP%\_mei27482\pyqt5\qt5\plugins\imageformats\qtiff.dll
- %TEMP%\_mei27482\pyqt5\qt5\plugins\imageformats\qwbmp.dll
- %TEMP%\_mei27482\pyqt5\qt5\plugins\imageformats\qwebp.dll
- %TEMP%\_mei27482\pyqt5\qt5\plugins\platforms\qminimal.dll
- %TEMP%\_mei27482\pyqt5\qt5\plugins\platforms\qoffscreen.dll
- %TEMP%\_mei27482\pyqt5\qt5\plugins\platforms\qwebgl.dll
- %TEMP%\_mei27482\pyqt5\qt5\plugins\platforms\qwindows.dll
- %TEMP%\_mei27482\pyqt5\qt5\plugins\platformthemes\qxdgdesktopportal.dll
- %TEMP%\_mei27482\pyqt5\qt5\plugins\styles\qwindowsvistastyle.dll
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_ar.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_bg.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_ca.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_cs.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_da.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_de.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_en.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_es.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_fa.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_fi.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_fr.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_gd.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_gl.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_he.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_help_ar.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_help_bg.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_help_ca.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_help_cs.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_help_da.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_help_de.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_help_en.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_help_es.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_help_fr.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_help_gl.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_help_hu.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_help_it.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_help_ja.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_help_ko.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_help_pl.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_help_ru.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_help_sk.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_help_sl.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_help_tr.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_help_uk.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_help_zh_cn.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_help_zh_tw.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_hu.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_it.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_ja.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_ko.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_lt.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_lv.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_pl.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_pt.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_ru.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_sk.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_sl.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_sv.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_tr.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_uk.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_zh_cn.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qt_zh_tw.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qtbase_ar.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qtbase_bg.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qtbase_ca.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qtbase_cs.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qtbase_da.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qtbase_de.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qtbase_en.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qtbase_es.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qtbase_fi.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qtbase_fr.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qtbase_gd.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qtbase_he.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qtbase_hu.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qtbase_it.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qtbase_ja.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qtbase_ko.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qtbase_lv.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qtbase_pl.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qtbase_ru.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qtbase_sk.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qtbase_tr.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qtbase_uk.qm
- %TEMP%\_mei27482\pyqt5\qt5\translations\qtbase_zh_tw.qm
- %TEMP%\_mei27482\pyqt5\qtcore.pyd
- %TEMP%\_mei27482\pyqt5\qtgui.pyd
- %TEMP%\_mei27482\pyqt5\qtwidgets.pyd
- %TEMP%\_mei27482\pyqt5\sip.cp38-win32.pyd
- %TEMP%\_mei27482\vcruntime140.dll
- %TEMP%\_mei27482\_asyncio.pyd
- %TEMP%\_mei27482\_bz2.pyd
- %TEMP%\_mei27482\_ctypes.pyd
- %TEMP%\_mei27482\_decimal.pyd
- %TEMP%\_mei27482\_hashlib.pyd
- %TEMP%\_mei27482\_lzma.pyd
- %TEMP%\_mei27482\_multiprocessing.pyd
- %TEMP%\_mei27482\_overlapped.pyd
- %TEMP%\_mei27482\_queue.pyd
- %TEMP%\_mei27482\_socket.pyd
- %TEMP%\_mei27482\_ssl.pyd
- %TEMP%\_mei27482\base_library.zip
- %TEMP%\_mei27482\certifi\cacert.pem
- %TEMP%\_mei27482\charset_normalizer\md.cp38-win32.pyd
- %TEMP%\_mei27482\charset_normalizer\md__mypyc.cp38-win32.pyd
- %TEMP%\_mei27482\libcrypto-1_1.dll
- %TEMP%\_mei27482\libffi-7.dll
- %TEMP%\_mei27482\libssl-1_1.dll
- %TEMP%\_mei27482\pyexpat.pyd
- %TEMP%\_mei27482\python3.dll
- %TEMP%\_mei27482\python38.dll
- %TEMP%\_mei27482\select.pyd
- %TEMP%\_mei27482\unicodedata.pyd
- %WINDIR%\syswow64\windowspowershell\v1.0\patch.log
- %WINDIR%\syswow64\windowspowershell\v1.0\newpatch.exe.bz
- %WINDIR%\syswow64\windowspowershell\v1.0\newpatch.exe
- %WINDIR%\syswow64\windowspowershell\v1.0\newpatch.bat.bz
- %WINDIR%\syswow64\windowspowershell\v1.0\newpatch.bat
- nul
- %TEMP%\_mei39042\pyqt5\qt5\bin\msvcp140.dll
- %TEMP%\_mei39042\pyqt5\qt5\bin\msvcp140_1.dll
- %TEMP%\_mei39042\pyqt5\qt5\bin\qt5core.dll
- %WINDIR%\syswow64\windowspowershell\v1.0\bgm\only_my_battle.mp3
- %TEMP%\_mei39042\pyqt5\qt5\bin\qt5dbus.dll
- %TEMP%\_mei39042\pyqt5\qt5\bin\qt5gui.dll
- %TEMP%\_mei39042\pyqt5\qt5\bin\qt5network.dll
- %TEMP%\_mei39042\pyqt5\qt5\bin\qt5qml.dll
- %WINDIR%\syswow64\windowspowershell\v1.0\bgm\a_rhapsody_of_war.mp3
- %TEMP%\_mei39042\pyqt5\qt5\bin\qt5qmlmodels.dll
- %TEMP%\_mei39042\pyqt5\qt5\bin\qt5quick.dll
- %TEMP%\_mei39042\pyqt5\qt5\bin\qt5svg.dll
- %TEMP%\_mei39042\pyqt5\qt5\bin\qt5websockets.dll
- %TEMP%\_mei39042\pyqt5\qt5\bin\qt5widgets.dll
- %TEMP%\_mei39042\pyqt5\qt5\bin\d3dcompiler_47.dll
- %TEMP%\_mei39042\pyqt5\qt5\bin\libegl.dll
- %TEMP%\_mei39042\pyqt5\qt5\bin\libglesv2.dll
- %TEMP%\_mei39042\pyqt5\qt5\bin\opengl32sw.dll
- %WINDIR%\syswow64\windowspowershell\v1.0\bgm\back_to_back.mp3
- %TEMP%\_mei39042\pyqt5\qt5\plugins\generic\qtuiotouchplugin.dll
- %TEMP%\_mei39042\pyqt5\qt5\plugins\iconengines\qsvgicon.dll
- %TEMP%\_mei39042\pyqt5\qt5\plugins\imageformats\qgif.dll
- %TEMP%\_mei39042\pyqt5\qt5\plugins\imageformats\qicns.dll
- %TEMP%\_mei39042\pyqt5\qt5\plugins\imageformats\qico.dll
- %TEMP%\_mei39042\pyqt5\qt5\plugins\imageformats\qjpeg.dll
- %TEMP%\_mei39042\pyqt5\qt5\plugins\imageformats\qsvg.dll
- %TEMP%\_mei39042\pyqt5\qt5\plugins\imageformats\qtga.dll
- %TEMP%\_mei39042\pyqt5\qt5\plugins\imageformats\qtiff.dll
- %TEMP%\_mei39042\pyqt5\qt5\plugins\imageformats\qwbmp.dll
- %TEMP%\_mei39042\pyqt5\qt5\plugins\imageformats\qwebp.dll
- %TEMP%\_mei39042\pyqt5\qt5\plugins\platforms\qminimal.dll
- %TEMP%\_mei39042\pyqt5\qt5\plugins\platforms\qoffscreen.dll
- %WINDIR%\syswow64\windowspowershell\v1.0\bgm\death_of_landmark.mp3
- %TEMP%\_mei39042\pyqt5\qt5\plugins\platforms\qwebgl.dll
- %TEMP%\_mei39042\pyqt5\qt5\plugins\platforms\qwindows.dll
- %TEMP%\_mei39042\pyqt5\qt5\plugins\platformthemes\qxdgdesktopportal.dll
- %TEMP%\_mei39042\pyqt5\qt5\plugins\styles\qwindowsvistastyle.dll
- %TEMP%\_mei39042\pyqt5\qtcore.pyd
- %TEMP%\_mei39042\pyqt5\qtgui.pyd
- %TEMP%\_mei39042\pyqt5\qtwidgets.pyd
- %TEMP%\_mei39042\pyqt5\sip.cp37-win32.pyd
- %TEMP%\_mei39042\vcruntime140.dll
- %TEMP%\_mei39042\_asyncio.pyd
- %TEMP%\_mei39042\_bz2.pyd
- %TEMP%\_mei39042\_ctypes.pyd
- %TEMP%\_mei39042\_decimal.pyd
- %TEMP%\_mei39042\_hashlib.pyd
- %TEMP%\_mei39042\_lzma.pyd
- %TEMP%\_mei39042\_multiprocessing.pyd
- %TEMP%\_mei39042\_overlapped.pyd
- %TEMP%\_mei39042\_queue.pyd
- %TEMP%\_mei39042\_socket.pyd
- %TEMP%\_mei39042\_ssl.pyd
- %TEMP%\_mei39042\charset_normalizer\md.cp37-win32.pyd
- %TEMP%\_mei39042\charset_normalizer\md__mypyc.cp37-win32.pyd
- %TEMP%\_mei39042\libcrypto-1_1.dll
- %TEMP%\_mei39042\libssl-1_1.dll
- %TEMP%\_mei39042\pyexpat.pyd
- %WINDIR%\syswow64\windowspowershell\v1.0\bgm\enter_the_east.mp3
- %TEMP%\_mei39042\python3.dll
- %TEMP%\_mei39042\python37.dll
- %TEMP%\_mei39042\select.pyd
- %TEMP%\_mei39042\unicodedata.pyd
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_ar.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_bg.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_ca.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_cs.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_da.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_de.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_en.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_es.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_fa.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_fi.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_fr.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_gd.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_gl.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_he.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_help_ar.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_help_bg.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_help_ca.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_help_cs.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_help_da.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_help_de.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_help_en.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_help_es.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_help_fr.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_help_gl.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_help_hu.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_help_it.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_help_ja.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_help_ko.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_help_pl.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_help_ru.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_help_sk.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_help_sl.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_help_tr.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_help_uk.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_help_zh_cn.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_help_zh_tw.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_hu.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_it.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_ja.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_ko.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_lt.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_lv.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_pl.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_pt.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_ru.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_sk.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_sl.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_sv.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_tr.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_uk.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_zh_cn.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qt_zh_tw.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qtbase_ar.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qtbase_bg.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qtbase_ca.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qtbase_cs.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qtbase_da.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qtbase_de.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qtbase_en.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qtbase_es.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qtbase_fi.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qtbase_fr.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qtbase_gd.qm
- %WINDIR%\syswow64\windowspowershell\v1.0\bgm\follow_war_god.mp3
- %TEMP%\_mei39042\pyqt5\qt5\translations\qtbase_he.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qtbase_hu.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qtbase_it.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qtbase_ja.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qtbase_ko.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qtbase_lv.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qtbase_pl.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qtbase_ru.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qtbase_sk.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qtbase_tr.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qtbase_uk.qm
- %TEMP%\_mei39042\pyqt5\qt5\translations\qtbase_zh_tw.qm
- %TEMP%\_mei39042\base_library.zip
- %TEMP%\_mei39042\certifi\cacert.pem
- %WINDIR%\syswow64\windowspowershell\v1.0\bgm\last-war2.mp3
- %WINDIR%\syswow64\windowspowershell\v1.0\bgm\lost_my_name.mp3
- %WINDIR%\syswow64\windowspowershell\v1.0\bgm\monkey_temple.mp3
- %WINDIR%\syswow64\windowspowershell\v1.0\bgm\mountain_of_death.mp3
- %WINDIR%\syswow64\windowspowershell\v1.0\bgm\open_the_gate.mp3
- %WINDIR%\syswow64\windowspowershell\v1.0\bgm\save_me.mp3
- %WINDIR%\syswow64\windowspowershell\v1.0\bgm\wedding.mp3
- %WINDIR%\syswow64\windowspowershell\v1.0\bgm\wonderland.mp3
- %WINDIR%\syswow64\windowspowershell\v1.0\bgm\xmas.mp3
- %WINDIR%\syswow64\windowspowershell\v1.0\dsetup.dll.bz
- %WINDIR%\syswow64\windowspowershell\v1.0\dsetup.dll
- %WINDIR%\syswow64\windowspowershell\v1.0\speedtreert.dll.bz
- %WINDIR%\syswow64\windowspowershell\v1.0\speedtreert.dll
- %WINDIR%\syswow64\windowspowershell\v1.0\artpclnt.dll.bz
- %WINDIR%\syswow64\windowspowershell\v1.0\artpclnt.dll
- %WINDIR%\syswow64\windowspowershell\v1.0\cef.pak
- %WINDIR%\syswow64\windowspowershell\v1.0\cef_100_percent.pak
- %WINDIR%\syswow64\windowspowershell\v1.0\cef_200_percent.pak
- %WINDIR%\syswow64\windowspowershell\v1.0\cef_extensions.pak
- %WINDIR%\syswow64\windowspowershell\v1.0\chrome_elf.dll.bz
- %WINDIR%\syswow64\windowspowershell\v1.0\chrome_elf.dll
- %WINDIR%\syswow64\windowspowershell\v1.0\config.exe.bz
- %WINDIR%\syswow64\windowspowershell\v1.0\config.exe
- %WINDIR%\syswow64\windowspowershell\v1.0\crashrpt.dll.bz
- %WINDIR%\syswow64\windowspowershell\v1.0\crashrpt.dll
- %WINDIR%\syswow64\windowspowershell\v1.0\d3dcompiler_47.dll.bz
- %WINDIR%\syswow64\windowspowershell\v1.0\d3dcompiler_47.dll
- %WINDIR%\syswow64\windowspowershell\v1.0\d3dx9_43.dll.bz
- %WINDIR%\syswow64\windowspowershell\v1.0\d3dx9_43.dll
- %WINDIR%\syswow64\windowspowershell\v1.0\devil.dll.bz
- %WINDIR%\syswow64\windowspowershell\v1.0\devil.dll
- %WINDIR%\syswow64\windowspowershell\v1.0\devtools_resources.pak
- %WINDIR%\syswow64\windowspowershell\v1.0\discord-rpc.dll.bz
- %WINDIR%\syswow64\windowspowershell\v1.0\discord-rpc.dll
- %WINDIR%\syswow64\windowspowershell\v1.0\granny2.dll.bz
- %WINDIR%\syswow64\windowspowershell\v1.0\granny2.dll
- %WINDIR%\syswow64\windowspowershell\v1.0\icudtl.dat
- %WINDIR%\syswow64\windowspowershell\v1.0\ijl15.dll.bz
- %WINDIR%\syswow64\windowspowershell\v1.0\ijl15.dll
- %WINDIR%\syswow64\windowspowershell\v1.0\ilu.dll.bz
- %WINDIR%\syswow64\windowspowershell\v1.0\ilu.dll
- %WINDIR%\syswow64\windowspowershell\v1.0\libegl.dll.bz
- %WINDIR%\syswow64\windowspowershell\v1.0\libegl.dll
- %WINDIR%\syswow64\windowspowershell\v1.0\libglesv2.dll.bz
- %WINDIR%\syswow64\windowspowershell\v1.0\libglesv2.dll
- %WINDIR%\syswow64\windowspowershell\v1.0\libcef.dll.bz
Moves the following files
- from %WINDIR%\syswow64\windowspowershell\v1.0\newpatch.exe to %WINDIR%\syswow64\windowspowershell\v1.0\locmt2.exe
Network activity
Connects to
- 's3.#ebi.io':80
TCP
HTTP GET requests
- http://s3.#ebi.io/locpatcher/m2client/BGM/enter_the_east.mp3
- http://s3.#ebi.io/locpatcher/m2client/BGM/monkey_temple.mp3
- http://s3.#ebi.io/locpatcher/m2client/libcef.dll.bz
UDP
- DNS ASK s3.#ebi.io
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\locmt2.exe' clean
Restarts the analyzed sample
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c newpatch.bat
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 5
