Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\_mei23442\licensemalwarebytes.exe.manifest
- %TEMP%\_mei23442\libssl-1_1.dll
- %TEMP%\_mei23442\libcrypto-1_1.dll
- %TEMP%\_mei23442\cryptography\hazmat\bindings\_openssl.pyd
- %TEMP%\_mei23442\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei23442\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei23442\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei23442\pyexpat.pyd
- %TEMP%\_mei23442\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei23442\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei23442\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei23442\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei23442\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei23442\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei23442\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei23442\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei23442\cryptography-3.1-py3.7.egg-info\authors.rst
- %TEMP%\_mei23442\cryptography-3.1-py3.7.egg-info\wheel
- %TEMP%\_mei23442\select.pyd
- %TEMP%\_mei23442\cryptography-3.1-py3.7.egg-info\record
- %TEMP%\_mei23442\cryptography-3.1-py3.7.egg-info\metadata
- %TEMP%\_mei23442\cryptography-3.1-py3.7.egg-info\license.psf
- %TEMP%\_mei23442\cryptography-3.1-py3.7.egg-info\license.bsd
- %TEMP%\_mei23442\cryptography-3.1-py3.7.egg-info\license.apache
- %TEMP%\_mei23442\cryptography-3.1-py3.7.egg-info\license
- %TEMP%\_mei23442\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei23442\cryptography-3.1-py3.7.egg-info\installer
- %TEMP%\_mei23442\base_library.zip
- %TEMP%\_mei23442\ca\client.key
- %TEMP%\_mei23442\ca\ca.key
- %TEMP%\_mei23442\ca\ca.crt
- %TEMP%\_mei23442\unicodedata.pyd
- %TEMP%\_mei23442\ucrtbase.dll
- %TEMP%\_mei23442\python3.dll
- %TEMP%\_mei23442\python37.dll
- %TEMP%\_mei23442\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei23442\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei23442\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei23442\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei23442\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei23442\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei23442\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei23442\_ssl.pyd
- %TEMP%\_mei23442\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei23442\_socket.pyd
- %TEMP%\_mei23442\_hashlib.pyd
- %TEMP%\_mei23442\_decimal.pyd
- %TEMP%\_mei23442\_ctypes.pyd
- %TEMP%\_mei23442\_cffi_backend.cp37-win32.pyd
- %TEMP%\_mei23442\_bz2.pyd
- %TEMP%\_mei23442\vcruntime140.dll
- %TEMP%\_mei23442\_lzma.pyd
- %TEMP%\_mei23442\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei23442\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei23442\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei23442\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei23442\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei23442\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei23442\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei23442\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei23442\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei23442\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei23442\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei23442\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei23442\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei23442\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei23442\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei23442\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei23442\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei23442\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei23442\cryptography-3.1-py3.7.egg-info\top_level.txt
Подменяет следующие файлы
- %ALLUSERSPROFILE%\ntuser.pol
- %HOMEPATH%\ntuser.pol
Изменяет файл HOSTS.
Другое
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c gpupdate /force
- '%WINDIR%\syswow64\gpupdate.exe' /force
- '<SYSTEM32>\gpscript.exe' /RefreshSystemParam
- '<SYSTEM32>\raserver.exe' /offerraupdate
