Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\bypass.exe
Modifies file system
Creates the following files
- %TEMP%\_mei23642\startup.exe.manifest
- %TEMP%\_mei29522\_lzma.pyd
- %TEMP%\_mei29522\_socket.pyd
- %TEMP%\_mei29522\_ssl.pyd
- %TEMP%\_mei29522\_win32sysloader.pyd
- %TEMP%\_mei29522\libcrypto-1_1.dll
- %TEMP%\_mei29522\libssl-1_1.dll
- %TEMP%\_mei29522\mfc140u.dll
- %TEMP%\_mei29522\pyexpat.pyd
- %TEMP%\_mei29522\python37.dll
- %TEMP%\_mei29522\pythoncom37.dll
- %TEMP%\_mei29522\pywintypes37.dll
- %TEMP%\_mei29522\select.pyd
- %TEMP%\_mei29522\win32api.pyd
- %WINDIR%\temp\aute58d.tmp
- %TEMP%\_mei29522\win32com\shell\shell.pyd
- %TEMP%\_mei29522\win32trace.pyd
- %TEMP%\_mei29522\win32ui.pyd
- %TEMP%\_mei29522\bypass.exe
- %TEMP%\_mei29522\include\pyconfig.h
- %TEMP%\_mei29522\microsoft edge.exe
- %TEMP%\_mei29522\process.exe
- %TEMP%\_mei29522\base_library.zip
- %TEMP%\3vxt6ew4
- %TEMP%\defender.exe
- %TEMP%\autd9bb.tmp
- %TEMP%\ujbzedh
- %TEMP%\_mei29522\_hashlib.pyd
- %TEMP%\_mei29522\unicodedata.pyd
- %TEMP%\_mei29522\_bz2.pyd
- %TEMP%\_mei23642\pythoncom37.dll
- %TEMP%\_mei23642\vcruntime140.dll
- %TEMP%\_mei23642\_bz2.pyd
- %TEMP%\_mei23642\_hashlib.pyd
- %TEMP%\_mei23642\_lzma.pyd
- %TEMP%\_mei23642\_socket.pyd
- %TEMP%\_mei23642\_ssl.pyd
- %TEMP%\_mei23642\_win32sysloader.pyd
- %TEMP%\_mei23642\libcrypto-1_1.dll
- %TEMP%\_mei23642\libssl-1_1.dll
- %TEMP%\_mei23642\mfc140u.dll
- %TEMP%\_mei23642\pyexpat.pyd
- %TEMP%\_mei23642\python37.dll
- %TEMP%\_mei23642\pywintypes37.dll
- %TEMP%\_mei29522\startup.exe.manifest
- %TEMP%\_mei23642\select.pyd
- %TEMP%\_mei23642\unicodedata.pyd
- %TEMP%\_mei23642\win32api.pyd
- %TEMP%\_mei23642\win32com\shell\shell.pyd
- %TEMP%\_mei23642\win32trace.pyd
- %TEMP%\_mei23642\win32ui.pyd
- %TEMP%\_mei23642\bypass.exe
- %TEMP%\_mei23642\include\pyconfig.h
- %TEMP%\_mei23642\microsoft edge.exe
- %TEMP%\_mei23642\process.exe
- %TEMP%\_mei23642\base_library.zip
- %TEMP%\lf56at7l
- %TEMP%\_mei29522\vcruntime140.dll
- %WINDIR%\temp\uqqwkfq
Deletes the following files
- %TEMP%\lf56at7l
- %TEMP%\defender.exe
- %TEMP%\ujbzedh
- %TEMP%\autd9bb.tmp
- %TEMP%\_mei23642\_win32sysloader.pyd
- %TEMP%\_mei23642\_ssl.pyd
- %TEMP%\_mei23642\_socket.pyd
- %TEMP%\_mei23642\_lzma.pyd
- %TEMP%\_mei23642\_hashlib.pyd
- %TEMP%\_mei23642\_bz2.pyd
- %TEMP%\_mei23642\win32ui.pyd
- %TEMP%\_mei23642\win32trace.pyd
- %TEMP%\_mei23642\win32com\shell\shell.pyd
- %TEMP%\_mei23642\win32api.pyd
- %TEMP%\_mei23642\vcruntime140.dll
- %WINDIR%\temp\aute58d.tmp
- %TEMP%\_mei23642\unicodedata.pyd
- %TEMP%\_mei23642\select.pyd
- %TEMP%\_mei23642\pywintypes37.dll
- %TEMP%\_mei23642\pythoncom37.dll
- %TEMP%\_mei23642\python37.dll
- %TEMP%\_mei23642\pyexpat.pyd
- %TEMP%\_mei23642\process.exe
- %TEMP%\_mei23642\microsoft edge.exe
- %TEMP%\_mei23642\mfc140u.dll
- %TEMP%\_mei23642\libssl-1_1.dll
- %TEMP%\_mei23642\libcrypto-1_1.dll
- %TEMP%\_mei23642\include\pyconfig.h
- %TEMP%\_mei23642\bypass.exe
- %TEMP%\_mei23642\base_library.zip
- %TEMP%\3vxt6ew4
- %TEMP%\_mei23642\startup.exe.manifest
- %WINDIR%\temp\uqqwkfq
Substitutes the following files
- %ALLUSERSPROFILE%\ntuser.pol
- %HOMEPATH%\ntuser.pol
- %ALLUSERSPROFILE%\tempntuser.pol
Miscellaneous
Creates and executes the following
- '%APPDATA%\microsoft\windows\start menu\programs\startup\bypass.exe'
- '%TEMP%\defender.exe' /D
- '<Full path to file>' <Full path to file> asadmin' (with hidden window)
Executes the following
- '<SYSTEM32>\gpscript.exe' /RefreshSystemParam
- '<SYSTEM32>\raserver.exe' /offerraupdate
