Technical Information
Modifies file system
Creates the following files
- %TEMP%\aute031.tmp
- %TEMP%\upewin_7\miso_2.bmp
- %TEMP%\aut2ee.tmp
- %TEMP%\upewin_7\miso_1.bmp
- %TEMP%\aut2de.tmp
- %TEMP%\upewin_7\qq3.bmp
- %TEMP%\aut2cd.tmp
- %TEMP%\upewin_7\qq2.bmp
- %TEMP%\aut2ad.tmp
- %TEMP%\upewin_7\qq1.bmp
- %TEMP%\aut28d.tmp
- %TEMP%\upewin_7\iso_3.bmp
- %TEMP%\aut27c.tmp
- %TEMP%\upewin_7\iso_2.bmp
- %TEMP%\aut26c.tmp
- %TEMP%\upewin_7\iso_1.bmp
- %TEMP%\aut22c.tmp
- %TEMP%\upewin_7\diy_1_3.bmp
- %TEMP%\aut21c.tmp
- %TEMP%\upewin_7\diy_1_2.bmp
- %TEMP%\aut1fb.tmp
- %TEMP%\upewin_7\diy_1_1.bmp
- %TEMP%\aut1db.tmp
- %TEMP%\upewin_7\btn_3_3.bmp
- %TEMP%\aut30f.tmp
- %TEMP%\upewin_7\miso_3.bmp
- %HOMEPATH%\desktop\梵猴启动盘.lnk
- %TEMP%\aut476.tmp
- %TEMP%\upewin_7\usb.ini
- %TEMP%\upewin_7\bootice.exe
- %TEMP%\autac8.tmp
- %TEMP%\upewin_7\btn_1_4.bmp
- %TEMP%\autaa8.tmp
- %TEMP%\upewin_7\menu_3.bmp
- %TEMP%\aut5a8.tmp
- %TEMP%\upewin_7\menu_2.bmp
- %TEMP%\aut597.tmp
- %TEMP%\upewin_7\menu_1.bmp
- %TEMP%\aut577.tmp
- %TEMP%\aut566.tmp
- %TEMP%\upewin_7\min_3.bmp
- %TEMP%\upewin_7\min_2.bmp
- %TEMP%\aut546.tmp
- %TEMP%\upewin_7\min_1.bmp
- %TEMP%\aut536.tmp
- %TEMP%\upewin_7\close_3.bmp
- %TEMP%\aut4e7.tmp
- %TEMP%\upewin_7\close_2.bmp
- %TEMP%\aut4c6.tmp
- %TEMP%\upewin_7\close_1.bmp
- %TEMP%\aut4b6.tmp
- %TEMP%\upewin_7\main.jpg
- %TEMP%\aut193a.tmp
- %TEMP%\aut1ab.tmp
- %TEMP%\upewin_7\btn_3_2.bmp
- %TEMP%\aut19b.tmp
- %TEMP%\aut35.tmp
- %TEMP%\upewin_7\succes.bmp
- %TEMP%\aut14.tmp
- %TEMP%\upewin_7\icon.ico
- %TEMP%\autfff4.tmp
- %TEMP%\upewin_7\info\update.ini
- %TEMP%\e3ab.tmp
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\f5jvltmr\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\33utrgp3\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\f4jpl9c3\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\m2b9qfpg\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %TEMP%\upewin_7\load.jpg
- %TEMP%\aute63c.tmp
- %TEMP%\upewin_7\wait.gif
- %TEMP%\aute62b.tmp
- %TEMP%\2752zdozfov
- %TEMP%\upewin_7\false.bmp
- %TEMP%\aut45.tmp
- %TEMP%\upewin_7\progress.gif
- %TEMP%\aut65.tmp
- %TEMP%\aut18a.tmp
- %TEMP%\upewin_7\btn_2_3.bmp
- %TEMP%\aut17a.tmp
- %TEMP%\upewin_7\btn_2_2.bmp
- %TEMP%\aut14a.tmp
- %TEMP%\upewin_7\btn_2_1.bmp
- %TEMP%\aut12a.tmp
- %TEMP%\upewin_7\btn_1_3.bmp
- %TEMP%\aut119.tmp
- %TEMP%\upewin_7\btn_1_2.bmp
- %TEMP%\aut108.tmp
- %TEMP%\aute8.tmp
- %TEMP%\upewin_7\btn_1_1.bmp
- %TEMP%\upewin_7\ok_3.bmp
- %TEMP%\autd8.tmp
- %TEMP%\upewin_7\ok_2.bmp
- %TEMP%\autb7.tmp
- %TEMP%\upewin_7\ok_1.bmp
- %TEMP%\auta7.tmp
- %TEMP%\upewin_7\no_3.bmp
- %TEMP%\aut87.tmp
- %TEMP%\upewin_7\no_2.bmp
- %TEMP%\aut76.tmp
- %TEMP%\upewin_7\no_1.bmp
- %TEMP%\upewin_7\btn_3_1.bmp
- %TEMP%\upewin_7\lvse.jpg
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\m2b9qfpg\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\f4jpl9c3\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\33utrgp3\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\f5jvltmr\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
Deletes the following files
- %TEMP%\aute031.tmp
- %TEMP%\aut21c.tmp
- %TEMP%\aut22c.tmp
- %TEMP%\aut26c.tmp
- %TEMP%\aut27c.tmp
- %TEMP%\aut28d.tmp
- %TEMP%\aut2ad.tmp
- %TEMP%\aut2cd.tmp
- %TEMP%\aut2de.tmp
- %TEMP%\aut2ee.tmp
- %TEMP%\aut30f.tmp
- %TEMP%\aut476.tmp
- %TEMP%\aut4b6.tmp
- %TEMP%\aut4c6.tmp
- %TEMP%\aut4e7.tmp
- %TEMP%\aut536.tmp
- %TEMP%\aut546.tmp
- %TEMP%\aut566.tmp
- %TEMP%\aut577.tmp
- %TEMP%\aut597.tmp
- %TEMP%\aut5a8.tmp
- %TEMP%\autaa8.tmp
- %TEMP%\aut1fb.tmp
- %TEMP%\autac8.tmp
- %TEMP%\aut1db.tmp
- %TEMP%\aut19b.tmp
- %TEMP%\2752zdozfov
- %TEMP%\aute62b.tmp
- %TEMP%\aute63c.tmp
- %TEMP%\e3ab.tmp
- %TEMP%\autfff4.tmp
- %TEMP%\aut14.tmp
- %TEMP%\aut35.tmp
- %TEMP%\aut45.tmp
- %TEMP%\aut65.tmp
- %TEMP%\aut76.tmp
- %TEMP%\aut87.tmp
- %TEMP%\auta7.tmp
- %TEMP%\autb7.tmp
- %TEMP%\autd8.tmp
- %TEMP%\aute8.tmp
- %TEMP%\aut108.tmp
- %TEMP%\aut119.tmp
- %TEMP%\aut12a.tmp
- %TEMP%\aut14a.tmp
- %TEMP%\aut17a.tmp
- %TEMP%\aut18a.tmp
- %TEMP%\aut1ab.tmp
- %TEMP%\aut193a.tmp
Network activity
Connects to
- 'pe##s.com':80
TCP
HTTP GET requests
- http://pe##s.com/fanhou_2020/upv8.txt
UDP
- DNS ASK ba##u.com
- DNS ASK pe##s.com
Miscellaneous
Creates and executes the following
- '%TEMP%\upewin_7\bootice.exe' /diskinfo /list: /usbonly /file=%TEMP%\UPEWIN_7\USB.INI
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\UPEWIN_7\BOOTICE.exe /diskinfo /list: /usbonly /file=%TEMP%\UPEWIN_7\USB.INI' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\UPEWIN_7\BOOTICE.exe /diskinfo /list: /usbonly /file=%TEMP%\UPEWIN_7\USB.INI
