Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\hq realtek sound controller.exe
Modifies file system
Creates the following files
- %TEMP%\_mei24402\vcruntime140.dll
- %TEMP%\_mei8682\select.pyd
- %TEMP%\_mei8682\pywintypes37.dll
- %TEMP%\_mei8682\python37.dll
- %TEMP%\_mei8682\python3.dll
- %TEMP%\_mei8682\pyexpat.pyd
- %TEMP%\_mei8682\opengl32sw.dll
- %TEMP%\_mei8682\minify.exe.manifest
- %TEMP%\_mei8682\libssl-1_1.dll
- %TEMP%\_mei8682\libcrypto-1_1.dll
- %TEMP%\_mei8682\unicodedata.pyd
- %TEMP%\_mei8682\libglesv2.dll
- %TEMP%\_mei8682\d3dcompiler_47.dll
- %TEMP%\_mei8682\_ssl.pyd
- %TEMP%\_mei8682\_socket.pyd
- %TEMP%\_mei8682\_pytransform.dll
- %TEMP%\_mei8682\_lzma.pyd
- %TEMP%\_mei8682\_hashlib.pyd
- %TEMP%\_mei8682\_ctypes.pyd
- %TEMP%\_mei8682\_bz2.pyd
- %TEMP%\_mei8682\vcruntime140_1.dll
- %TEMP%\_mei8682\libegl.dll
- %TEMP%\_mei8682\pyqt5\qt5\translations\qtbase_he.qm
- %TEMP%\_mei8682\pyqt5\qt5\translations\qtbase_zh_tw.qm
- %TEMP%\_mei8682\pyqt5\qt5\translations\qtbase_bg.qm
- %TEMP%\_mei8682\pyqt5\qt5\translations\qtbase_uk.qm
- %TEMP%\_mei8682\pyqt5\qt5\translations\qtbase_tr.qm
- %TEMP%\_mei8682\pyqt5\qt5\translations\qtbase_sk.qm
- %TEMP%\_mei8682\pyqt5\qt5\translations\qtbase_ru.qm
- %TEMP%\_mei8682\pyqt5\qt5\translations\qtbase_pl.qm
- %TEMP%\_mei8682\pyqt5\qt5\translations\qtbase_lv.qm
- %TEMP%\_mei8682\pyqt5\qt5\translations\qtbase_ko.qm
- %TEMP%\_mei8682\pyqt5\qt5\translations\qtbase_ja.qm
- %TEMP%\_mei8682\pyqt5\qt5\translations\qtbase_it.qm
- %TEMP%\_mei8682\vcruntime140.dll
- %TEMP%\_mei8682\pyqt5\qt5\translations\qtbase_hu.qm
- %TEMP%\_mei8682\pyqt5\qt5\translations\qtbase_gd.qm
- %TEMP%\_mei8682\pyqt5\qt5\translations\qtbase_fr.qm
- %TEMP%\_mei8682\pyqt5\qt5\translations\qtbase_fi.qm
- %TEMP%\_mei8682\pyqt5\qt5\translations\qtbase_es.qm
- %TEMP%\_mei8682\pyqt5\qt5\translations\qtbase_en.qm
- %TEMP%\_mei8682\pyqt5\qt5\translations\qtbase_de.qm
- %TEMP%\_mei8682\pyqt5\qt5\translations\qtbase_da.qm
- %TEMP%\_mei8682\pyqt5\qt5\translations\qtbase_cs.qm
- %TEMP%\_mei8682\pyqt5\qt5\translations\qtbase_ca.qm
- %TEMP%\_mei8682\win32clipboard.pyd
- %TEMP%\_mei8682\pyqt5\qt5\translations\qtbase_ar.qm
- %TEMP%\_mei8682\qt5widgets.dll
- %TEMP%\_mei8682\pyqt5\qt5\plugins\imageformats\qsvg.dll
- %TEMP%\_mei8682\pyqt5\qt5\plugins\imageformats\qicns.dll
- %TEMP%\_mei8682\pyqt5\qt5\plugins\imageformats\qgif.dll
- %TEMP%\_mei8682\pyqt5\qt5\plugins\iconengines\qsvgicon.dll
- %TEMP%\_mei8682\msvcp140_1.dll
- %TEMP%\_mei8682\msvcp140.dll
- %TEMP%\_mei24402\base_library.zip
- %TEMP%\_mei24402\toinject\to_inject.exe
- %TEMP%\_mei24402\toinject\adobe gc updater.exe
- %TEMP%\_mei24402\xidrf.exe.manifest
- %TEMP%\_mei8682\pyqt5\qt5\plugins\imageformats\qico.dll
- %TEMP%\_mei24402\unicodedata.pyd
- %TEMP%\_mei24402\python37.dll
- %TEMP%\_mei24402\pyexpat.pyd
- %TEMP%\_mei24402\libssl-1_1.dll
- %TEMP%\_mei24402\libcrypto-1_1.dll
- %TEMP%\_mei24402\_ssl.pyd
- %TEMP%\_mei24402\_socket.pyd
- %TEMP%\_mei24402\_lzma.pyd
- %TEMP%\_mei24402\_hashlib.pyd
- %TEMP%\_mei24402\_bz2.pyd
- %TEMP%\_mei24402\select.pyd
- %TEMP%\_mei8682\pyqt5\qtcore.pyd
- %TEMP%\_mei8682\qt5svg.dll
- %TEMP%\_mei8682\pyqt5\qt5\plugins\imageformats\qtga.dll
- %TEMP%\_mei8682\qt5quick.dll
- %TEMP%\_mei8682\qt5qmlmodels.dll
- %TEMP%\_mei8682\qt5qml.dll
- %TEMP%\_mei8682\qt5network.dll
- %TEMP%\_mei8682\qt5gui.dll
- %TEMP%\_mei8682\qt5dbus.dll
- %TEMP%\_mei8682\qt5core.dll
- %TEMP%\_mei8682\pyqt5\sip.cp37-win_amd64.pyd
- %TEMP%\_mei8682\pyqt5\qtwidgets.pyd
- %TEMP%\_mei8682\qt5websockets.dll
- %TEMP%\_mei8682\pyqt5\qtgui.pyd
- %TEMP%\_mei8682\pyqt5\qt5\plugins\styles\qwindowsvistastyle.dll
- %TEMP%\_mei8682\pyqt5\qt5\plugins\platformthemes\qxdgdesktopportal.dll
- %TEMP%\_mei8682\pyqt5\qt5\plugins\platforms\qwindows.dll
- %TEMP%\_mei8682\pyqt5\qt5\plugins\platforms\qwebgl.dll
- %TEMP%\_mei8682\pyqt5\qt5\plugins\platforms\qoffscreen.dll
- %TEMP%\_mei8682\pyqt5\qt5\plugins\platforms\qminimal.dll
- %TEMP%\_mei8682\pyqt5\qt5\plugins\imageformats\qwebp.dll
- %TEMP%\_mei8682\pyqt5\qt5\plugins\imageformats\qwbmp.dll
- %TEMP%\_mei8682\pyqt5\qt5\plugins\imageformats\qtiff.dll
- %TEMP%\_mei8682\pyqt5\qt5\plugins\imageformats\qjpeg.dll
- %TEMP%\_mei8682\base_library.zip
Deletes the following files
- %TEMP%\_mei24402\base_library.zip
- %TEMP%\_mei24402\libcrypto-1_1.dll
- %TEMP%\_mei24402\libssl-1_1.dll
- %TEMP%\_mei24402\pyexpat.pyd
- %TEMP%\_mei24402\python37.dll
- %TEMP%\_mei24402\select.pyd
- %TEMP%\_mei24402\toinject\adobe gc updater.exe
- %TEMP%\_mei24402\toinject\to_inject.exe
- %TEMP%\_mei24402\unicodedata.pyd
- %TEMP%\_mei24402\vcruntime140.dll
- %TEMP%\_mei24402\xidrf.exe.manifest
- %TEMP%\_mei24402\_bz2.pyd
- %TEMP%\_mei24402\_hashlib.pyd
- %TEMP%\_mei24402\_lzma.pyd
- %TEMP%\_mei24402\_socket.pyd
- %TEMP%\_mei24402\_ssl.pyd
Miscellaneous
Creates and executes the following
- '%TEMP%\_mei24402\toinject\to_inject.exe'
- '%APPDATA%\microsoft\windows\start menu\programs\startup\hq realtek sound controller.exe'
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\_MEI24402\toInject/to_inject.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\HQ Realtek Sound Controller.exe""' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\_MEI24402\toInject/to_inject.exe"
- '<SYSTEM32>\cmd.exe' /c ""%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\HQ Realtek Sound Controller.exe""
- '<SYSTEM32>\wbem\wmic.exe' process list brief
