Техническая информация
Вредоносные функции
Читает файлы, отвечающие за хранение паролей сторонними программами
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\_mei23682\681306264.exe.manifest
- %TEMP%\_mei27242\_queue.pyd
- %TEMP%\_mei27242\_socket.pyd
- %TEMP%\_mei27242\_sqlite3.pyd
- %TEMP%\_mei27242\_ssl.pyd
- %TEMP%\_mei27242\_win32sysloader.pyd
- %TEMP%\_mei27242\libcrypto-1_1.dll
- %TEMP%\_mei27242\_lzma.pyd
- %TEMP%\_mei27242\_multiprocessing.pyd
- %TEMP%\_mei27242\libopenblas.noijjg62emaszi6nyurl6jbkm4evbgm7.gfortran-win_amd64.dll
- %TEMP%\_mei27242\numpy\core\_multiarray_tests.cp37-win_amd64.pyd
- %TEMP%\_mei27242\numpy\core\_multiarray_umath.cp37-win_amd64.pyd
- %TEMP%\_mei27242\numpy\fft\_pocketfft_internal.cp37-win_amd64.pyd
- %TEMP%\_mei27242\numpy\linalg\_umath_linalg.cp37-win_amd64.pyd
- %TEMP%\_mei27242\numpy\linalg\lapack_lite.cp37-win_amd64.pyd
- %TEMP%\_mei27242\numpy\random\_bounded_integers.cp37-win_amd64.pyd
- %TEMP%\_mei27242\libssl-1_1.dll
- %TEMP%\_mei27242\mfc140u.dll
- %TEMP%\_mei27242\numpy\random\_generator.cp37-win_amd64.pyd
- %TEMP%\_mei27242\numpy\random\_common.cp37-win_amd64.pyd
- %TEMP%\_mei27242\_decimal.pyd
- %TEMP%\_mei27242\crypto\hash\_ghash_portable.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\hash\_keccak.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\hash\_poly1305.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\math\_modexp.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\protocol\_scrypt.cp37-win_amd64.pyd
- %TEMP%\_mei27242\_elementtree.pyd
- %TEMP%\_mei27242\crypto\hash\_sha512.cp37-win_amd64.pyd
- %TEMP%\_mei27242\_hashlib.pyd
- %TEMP%\_mei27242\crypto\publickey\_ec_ws.cp37-win_amd64.pyd
- %TEMP%\_mei27242\pil\_imagingtk.cp37-win_amd64.pyd
- %TEMP%\_mei27242\pil\_webp.cp37-win_amd64.pyd
- %TEMP%\_mei27242\vcruntime140.dll
- %TEMP%\_mei27242\_bz2.pyd
- %TEMP%\_mei27242\_ctypes.pyd
- %TEMP%\_mei27242\crypto\util\_cpuid_c.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\util\_strxor.cp37-win_amd64.pyd
- %TEMP%\_mei27242\pil\_imaging.cp37-win_amd64.pyd
- %TEMP%\_mei23682\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei27242\numpy\random\_mt19937.cp37-win_amd64.pyd
- %TEMP%\_mei27242\certifi\cacert.pem
- %TEMP%\_mei27242\lib2to3\grammar3.7.6.final.0.pickle
- %TEMP%\_mei27242\lib2to3\patterngrammar.txt
- %TEMP%\_mei27242\lib2to3\patterngrammar3.7.6.final.0.pickle
- %TEMP%\_mei27242\lib2to3\tests\data\readme
- %TEMP%\fboc3bt5
- %TEMP%\_mei27242\base_library.zip
- nul
- %TEMP%\_mei27242\lib2to3\grammar.txt
- %LOCALAPPDATA%\tempinfo_edcczamqmjpvsjy.db
- %LOCALAPPDATA%\tempinfo_petqrixgfzmwr.db
- %LOCALAPPDATA%\tempinfo_pmyquflswtjmewfcunh.db
- %LOCALAPPDATA%\tempinfo_wnnbfkyxbeh.db
- %APPDATA%\testscreeeen.jpg
- %APPDATA%\passwords429779557.txt
- %LOCALAPPDATA%\tempinfo_wzijekebowgib.db
- %TEMP%\_mei27242\include\pyconfig.h
- %LOCALAPPDATA%\tempinfo_hgzpryjmzyqg.db
- %TEMP%\_mei27242\win32wnet.pyd
- %TEMP%\_mei27242\win32ui.pyd
- %TEMP%\_mei27242\numpy\random\_philox.cp37-win_amd64.pyd
- %TEMP%\_mei27242\numpy\random\bit_generator.cp37-win_amd64.pyd
- %TEMP%\_mei27242\numpy\random\mtrand.cp37-win_amd64.pyd
- %TEMP%\_mei27242\pyexpat.pyd
- %TEMP%\_mei27242\python37.dll
- %TEMP%\_mei27242\pythoncom37.dll
- %TEMP%\_mei27242\pywintypes37.dll
- %TEMP%\_mei27242\select.pyd
- %TEMP%\_mei27242\numpy\random\_sfc64.cp37-win_amd64.pyd
- %TEMP%\_mei27242\sqlite3.dll
- %TEMP%\_mei27242\unicodedata.pyd
- %TEMP%\_mei27242\win32api.pyd
- %TEMP%\_mei27242\win32com\shell\shell.pyd
- %TEMP%\_mei27242\win32gui.pyd
- %TEMP%\_mei27242\win32pdh.pyd
- %TEMP%\_mei27242\win32trace.pyd
- %TEMP%\_mei27242\crypto\hash\_sha384.cp37-win_amd64.pyd
- %TEMP%\_mei27242\stealer.exe.manifest
- %TEMP%\_mei27242\crypto\hash\_ghash_clmul.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\hash\_sha256.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\hash\_sha224.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\hash\_sha1.cp37-win_amd64.pyd
- %TEMP%\_mei23682\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei23682\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei23682\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei23682\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei23682\_bz2.pyd
- %TEMP%\_mei23682\_hashlib.pyd
- %TEMP%\_mei23682\_lzma.pyd
- %TEMP%\_mei23682\_socket.pyd
- %TEMP%\_mei23682\_ssl.pyd
- %TEMP%\_mei23682\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei23682\vcruntime140.dll
- %TEMP%\_mei23682\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei23682\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-errorhandling-l1-1-0.dll
- %APPDATA%\cookies429779557.txt
- %TEMP%\_mei27242\numpy\random\_pcg64.cp37-win_amd64.pyd
- %TEMP%\_mei23682\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei27242\crypto\cipher\_raw_cfb.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\cipher\_raw_ctr.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\cipher\_raw_des.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\cipher\_raw_des3.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\cipher\_raw_ecb.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\cipher\_raw_blowfish.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\cipher\_raw_eksblowfish.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\cipher\_raw_cbc.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\cipher\_raw_ofb.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\hash\_blake2s.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\hash\_md2.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\hash\_md4.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\hash\_md5.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\hash\_ripemd160.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\cipher\_raw_ocb.cp37-win_amd64.pyd
- %TEMP%\_mei23682\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei27242\crypto\hash\_blake2b.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\cipher\_raw_cast.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\cipher\_raw_arc2.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\cipher\_raw_aesni.cp37-win_amd64.pyd
- %TEMP%\_mei23682\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei23682\libcrypto-1_1.dll
- %TEMP%\_mei23682\libssl-1_1.dll
- %TEMP%\_mei23682\pyexpat.pyd
- %TEMP%\_mei23682\python37.dll
- %TEMP%\_mei23682\pywintypes37.dll
- %TEMP%\_mei23682\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei23682\select.pyd
- %TEMP%\_mei23682\unicodedata.pyd
- %TEMP%\_mei23682\win32gui.pyd
- %TEMP%\_mei23682\base_library.zip
- %APPDATA%\msvreg.exe
- %TEMP%\_mei27242\crypto\cipher\_arc4.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\cipher\_salsa20.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\cipher\_chacha20.cp37-win_amd64.pyd
- %TEMP%\_mei23682\ucrtbase.dll
- %TEMP%\_mei27242\crypto\cipher\_raw_aes.cp37-win_amd64.pyd
- %TEMP%\_mei23682\api-ms-win-crt-stdio-l1-1-0.dll
- %APPDATA%\429779557 95.211.190.199 de.zip
Удаляет следующие файлы
- %TEMP%\fboc3bt5
- %TEMP%\_mei27242\_sqlite3.pyd
- %TEMP%\_mei27242\_ssl.pyd
- %TEMP%\_mei27242\_win32sysloader.pyd
- %TEMP%\_mei23682\681306264.exe.manifest
- %TEMP%\_mei23682\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei23682\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei27242\_socket.pyd
- %TEMP%\_mei23682\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei27242\_queue.pyd
- %TEMP%\_mei27242\win32pdh.pyd
- %TEMP%\_mei27242\sqlite3.dll
- %TEMP%\_mei27242\stealer.exe.manifest
- %TEMP%\_mei27242\unicodedata.pyd
- %TEMP%\_mei27242\vcruntime140.dll
- %TEMP%\_mei27242\win32api.pyd
- %TEMP%\_mei27242\win32com\shell\shell.pyd
- %TEMP%\_mei27242\win32gui.pyd
- %TEMP%\_mei27242\win32trace.pyd
- %TEMP%\_mei27242\_lzma.pyd
- %TEMP%\_mei27242\win32ui.pyd
- %TEMP%\_mei27242\win32wnet.pyd
- %TEMP%\_mei27242\_bz2.pyd
- %TEMP%\_mei27242\_ctypes.pyd
- %TEMP%\_mei27242\_decimal.pyd
- %TEMP%\_mei27242\_elementtree.pyd
- %TEMP%\_mei27242\_hashlib.pyd
- %TEMP%\_mei27242\_multiprocessing.pyd
- %TEMP%\_mei23682\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei23682\_socket.pyd
- %TEMP%\_mei23682\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei23682\base_library.zip
- %TEMP%\_mei23682\libcrypto-1_1.dll
- %TEMP%\_mei23682\libssl-1_1.dll
- %TEMP%\_mei23682\pyexpat.pyd
- %TEMP%\_mei23682\python37.dll
- %TEMP%\_mei23682\select.pyd
- %TEMP%\_mei23682\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei23682\ucrtbase.dll
- %TEMP%\_mei23682\unicodedata.pyd
- %TEMP%\_mei23682\vcruntime140.dll
- %TEMP%\_mei23682\win32gui.pyd
- %TEMP%\_mei23682\_bz2.pyd
- %TEMP%\_mei23682\_hashlib.pyd
- %TEMP%\_mei23682\_lzma.pyd
- %TEMP%\_mei23682\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei27242\select.pyd
- %TEMP%\_mei23682\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei23682\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei23682\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei23682\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei23682\pywintypes37.dll
- %TEMP%\_mei27242\pywintypes37.dll
- %TEMP%\_mei27242\numpy\random\_generator.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\cipher\_raw_ctr.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\cipher\_raw_des.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\cipher\_raw_des3.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\cipher\_raw_ecb.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\cipher\_raw_eksblowfish.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\cipher\_raw_ocb.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\cipher\_raw_ofb.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\hash\_blake2b.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\hash\_poly1305.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\hash\_blake2s.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\hash\_ghash_clmul.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\hash\_ghash_portable.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\hash\_keccak.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\hash\_md2.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\hash\_md4.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\hash\_md5.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\cipher\_raw_cfb.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\cipher\_salsa20.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\cipher\_raw_cbc.cp37-win_amd64.pyd
- %APPDATA%\cookies429779557.txt
- %LOCALAPPDATA%\tempinfo_wzijekebowgib.db
- %LOCALAPPDATA%\tempinfo_edcczamqmjpvsjy.db
- %LOCALAPPDATA%\tempinfo_hgzpryjmzyqg.db
- %LOCALAPPDATA%\tempinfo_petqrixgfzmwr.db
- %LOCALAPPDATA%\tempinfo_pmyquflswtjmewfcunh.db
- %LOCALAPPDATA%\tempinfo_wnnbfkyxbeh.db
- %APPDATA%\passwords429779557.txt
- %APPDATA%\testscreeeen.jpg
- %TEMP%\_mei27242\crypto\cipher\_raw_blowfish.cp37-win_amd64.pyd
- %TEMP%\_mei27242\base_library.zip
- %TEMP%\_mei27242\certifi\cacert.pem
- %TEMP%\_mei27242\crypto\cipher\_arc4.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\cipher\_chacha20.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\cipher\_raw_aes.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\cipher\_raw_aesni.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\cipher\_raw_arc2.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\cipher\_raw_cast.cp37-win_amd64.pyd
- %TEMP%\_mei27242\include\pyconfig.h
- %TEMP%\_mei27242\python37.dll
- %TEMP%\_mei27242\crypto\hash\_sha224.cp37-win_amd64.pyd
- %TEMP%\_mei27242\numpy\fft\_pocketfft_internal.cp37-win_amd64.pyd
- %TEMP%\_mei27242\numpy\linalg\lapack_lite.cp37-win_amd64.pyd
- %TEMP%\_mei27242\numpy\linalg\_umath_linalg.cp37-win_amd64.pyd
- %TEMP%\_mei27242\numpy\random\bit_generator.cp37-win_amd64.pyd
- %TEMP%\_mei27242\numpy\random\mtrand.cp37-win_amd64.pyd
- %TEMP%\_mei27242\numpy\random\_bounded_integers.cp37-win_amd64.pyd
- %TEMP%\_mei27242\numpy\random\_common.cp37-win_amd64.pyd
- %TEMP%\_mei27242\numpy\random\_mt19937.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\hash\_sha1.cp37-win_amd64.pyd
- %TEMP%\_mei27242\numpy\random\_pcg64.cp37-win_amd64.pyd
- %TEMP%\_mei27242\numpy\random\_philox.cp37-win_amd64.pyd
- %TEMP%\_mei27242\numpy\random\_sfc64.cp37-win_amd64.pyd
- %TEMP%\_mei27242\pil\_imaging.cp37-win_amd64.pyd
- %TEMP%\_mei27242\pil\_imagingtk.cp37-win_amd64.pyd
- %TEMP%\_mei27242\pil\_webp.cp37-win_amd64.pyd
- %TEMP%\_mei27242\pyexpat.pyd
- %TEMP%\_mei27242\numpy\core\_multiarray_umath.cp37-win_amd64.pyd
- %TEMP%\_mei27242\pythoncom37.dll
- %TEMP%\_mei27242\numpy\core\_multiarray_tests.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\util\_strxor.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\hash\_sha256.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\hash\_sha384.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\hash\_sha512.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\math\_modexp.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\protocol\_scrypt.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\publickey\_ec_ws.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\util\_cpuid_c.cp37-win_amd64.pyd
- %TEMP%\_mei27242\crypto\hash\_ripemd160.cp37-win_amd64.pyd
- %TEMP%\_mei27242\libssl-1_1.dll
- %TEMP%\_mei27242\lib2to3\grammar.txt
- %TEMP%\_mei27242\lib2to3\grammar3.7.6.final.0.pickle
- %TEMP%\_mei27242\lib2to3\patterngrammar.txt
- %TEMP%\_mei27242\lib2to3\patterngrammar3.7.6.final.0.pickle
- %TEMP%\_mei27242\lib2to3\tests\data\readme
- %TEMP%\_mei27242\libcrypto-1_1.dll
- %TEMP%\_mei27242\libopenblas.noijjg62emaszi6nyurl6jbkm4evbgm7.gfortran-win_amd64.dll
- %TEMP%\_mei27242\mfc140u.dll
- %TEMP%\_mei23682\_ssl.pyd
Сетевая активность
TCP
- 'dr##box.com':443
- 'uc#############0848fb1d1a58d.dl.dropboxusercontent.com':443
- 'ap#.2ip.ua':443
- 'ap#.##legram.org':443
UDP
- DNS ASK dr##box.com
- DNS ASK uc#############0848fb1d1a58d.dl.dropboxusercontent.com
- DNS ASK ap#.2ip.ua
- DNS ASK ap#.##legram.org
Другое
Ищет следующие окна
- ClassName: 'ConsoleWindowClass' WindowName: ''
Создает и запускает на исполнение
- '%APPDATA%\msvreg.exe' ONQW46LBMJXXIMJTGM3Q====/GY4DCMZQGYZDMNA=/GIYDEMBNGEYS2MJW
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c %APPDATA%\msvreg.exe ONQW46LBMJXXIMJTGM3Q====/GY4DCMZQGYZDMNA=/GIYDEMBNGEYS2MJW
- '<SYSTEM32>\cmd.exe' /c @chcp 65001 1>nul
- '<SYSTEM32>\chcp.com' 65001
