Trojan.DownLoader36.24123

Техническая информация

Для обеспечения автозапуска и распространения

Создает или изменяет следующие файлы

%APPDATA%\microsoft\windows\start menu\programs\startup\123.lnk

Изменения в файловой системе

Создает следующие файлы

%TEMP%\_mei20922\123.exe.manifest
%TEMP%\_mei20922\numpy\random\philox.cp37-win_amd64.pyd
%TEMP%\_mei20922\numpy\random\pcg64.cp37-win_amd64.pyd
%TEMP%\_mei20922\numpy\random\mtrand.cp37-win_amd64.pyd
%TEMP%\_mei20922\numpy\random\mt19937.cp37-win_amd64.pyd
%TEMP%\_mei20922\numpy\random\generator.cp37-win_amd64.pyd
%TEMP%\_mei20922\numpy\random\common.cp37-win_amd64.pyd
%TEMP%\_mei20922\numpy\random\bounded_integers.cp37-win_amd64.pyd
%TEMP%\_mei20922\numpy\random\bit_generator.cp37-win_amd64.pyd
%TEMP%\_mei20922\numpy\linalg\lapack_lite.cp37-win_amd64.pyd
%TEMP%\_mei20922\numpy\linalg\_umath_linalg.cp37-win_amd64.pyd
%TEMP%\_mei20922\numpy\fft\_pocketfft_internal.cp37-win_amd64.pyd
%TEMP%\_mei20922\numpy\core\_multiarray_umath.cp37-win_amd64.pyd
%TEMP%\_mei20922\numpy\core\_multiarray_tests.cp37-win_amd64.pyd
%TEMP%\_mei20922\mfc140u.dll
%TEMP%\_mei20922\libssl-1_1.dll
%TEMP%\_mei20922\libopenblas.pyqhxlvvq7vesdpuvuadxevjobghjpay.gfortran-win_amd64.dll
%TEMP%\_mei20922\libcrypto-1_1.dll
%TEMP%\_mei20922\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei20922\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei20922\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei20922\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei20922\numpy\random\sfc64.cp37-win_amd64.pyd
%TEMP%\_mei20922\python37.dll
%TEMP%\tmppwj3nc0b\gen_py\__init__.py
%TEMP%\_mei20922\pythoncom37.dll
%TEMP%\5lmle1u4
%TEMP%\_mei20922\lib2to3\tests\data\readme
%TEMP%\_mei20922\lib2to3\patterngrammar3.7.5.final.0.pickle
%TEMP%\_mei20922\lib2to3\patterngrammar.txt
%TEMP%\_mei20922\lib2to3\grammar3.7.5.final.0.pickle
%TEMP%\_mei20922\lib2to3\grammar.txt
%TEMP%\_mei20922\certifi\cacert.pem
%TEMP%\_mei20922\base_library.zip
%TEMP%\_mei20922\include\pyconfig.h
%TEMP%\_mei20922\win32wnet.pyd
%TEMP%\_mei20922\win32ui.pyd
%TEMP%\_mei20922\win32trace.pyd
%TEMP%\_mei20922\win32pdh.pyd
%TEMP%\_mei20922\win32crypt.pyd
%TEMP%\_mei20922\win32com\shell\shell.pyd
%TEMP%\_mei20922\win32api.pyd
%TEMP%\_mei20922\unicodedata.pyd
%TEMP%\_mei20922\ucrtbase.dll
%TEMP%\_mei20922\sqlite3.dll
%TEMP%\_mei20922\select.pyd
%TEMP%\_mei20922\pywintypes37.dll
%TEMP%\_mei20922\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei20922\pyexpat.pyd
%TEMP%\_mei20922\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei20922\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei20922\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei20922\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei20922\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei20922\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei20922\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei20922\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei20922\_win32sysloader.pyd
%TEMP%\_mei20922\_ssl.pyd
%TEMP%\_mei20922\_sqlite3.pyd
%TEMP%\_mei20922\_socket.pyd
%TEMP%\_mei20922\_queue.pyd
%TEMP%\_mei20922\_multiprocessing.pyd
%TEMP%\_mei20922\_lzma.pyd
%TEMP%\_mei20922\_hashlib.pyd
%TEMP%\_mei20922\_decimal.pyd
%TEMP%\_mei20922\_ctypes.pyd
%TEMP%\_mei20922\_bz2.pyd
%TEMP%\_mei20922\vcruntime140.dll
%TEMP%\_mei20922\pil\_webp.cp37-win_amd64.pyd
%TEMP%\_mei20922\pil\_imagingtk.cp37-win_amd64.pyd
%TEMP%\_mei20922\pil\_imaging.cp37-win_amd64.pyd
%TEMP%\_mei20922\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei20922\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei20922\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei20922\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei20922\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei20922\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei20922\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei20922\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei20922\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei20922\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei20922\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei20922\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei20922\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei20922\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei20922\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei20922\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei20922\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei20922\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei20922\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei20922\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei20922\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei20922\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei20922\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei20922\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei20922\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei20922\api-ms-win-crt-multibyte-l1-1-0.dll
%TEMP%\tmppwj3nc0b\gen_py\dicts.dat