Trojan.DownLoader33.1996

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\def_notification.lnk

Modifies file system

Creates the following files

%TEMP%\_mei5642\def_notification.exe.manifest
%TEMP%\_mei5642\numpy\random\sfc64.cp37-win_amd64.pyd
%TEMP%\_mei5642\numpy\random\philox.cp37-win_amd64.pyd
%TEMP%\_mei5642\numpy\random\pcg64.cp37-win_amd64.pyd
%TEMP%\_mei5642\numpy\random\mtrand.cp37-win_amd64.pyd
%TEMP%\_mei5642\numpy\random\mt19937.cp37-win_amd64.pyd
%TEMP%\_mei5642\numpy\random\generator.cp37-win_amd64.pyd
%TEMP%\_mei5642\numpy\random\common.cp37-win_amd64.pyd
%TEMP%\_mei5642\numpy\random\bounded_integers.cp37-win_amd64.pyd
%TEMP%\_mei5642\numpy\random\bit_generator.cp37-win_amd64.pyd
%TEMP%\_mei5642\numpy\linalg\lapack_lite.cp37-win_amd64.pyd
%TEMP%\_mei5642\psutil\_psutil_windows.cp37-win_amd64.pyd
%TEMP%\_mei5642\numpy\linalg\_umath_linalg.cp37-win_amd64.pyd
%TEMP%\_mei5642\numpy\core\_multiarray_umath.cp37-win_amd64.pyd
%TEMP%\_mei5642\numpy\core\_multiarray_tests.cp37-win_amd64.pyd
%TEMP%\_mei5642\mfc140u.dll
%TEMP%\_mei5642\libssl-1_1-x64.dll
%TEMP%\_mei5642\libopenblas.pyqhxlvvq7vesdpuvuadxevjobghjpay.gfortran-win_amd64.dll
%TEMP%\_mei5642\libcrypto-1_1-x64.dll
%TEMP%\_mei5642\cv2\cv2.cp37-win_amd64.pyd
%TEMP%\_mei5642\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei5642\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei5642\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei5642\numpy\fft\_pocketfft_internal.cp37-win_amd64.pyd
%TEMP%\_mei5642\win32trace.pyd
%TEMP%\tmpxq3ub0cy\gen_py\__init__.py
%TEMP%\_mei5642\pythoncom37.dll
%TEMP%\k0yxbfeq
%TEMP%\_mei5642\lib2to3\tests\data\readme
%TEMP%\_mei5642\lib2to3\patterngrammar3.7.0.final.0.pickle
%TEMP%\_mei5642\lib2to3\patterngrammar.txt
%TEMP%\_mei5642\lib2to3\grammar3.7.0.final.0.pickle
%TEMP%\_mei5642\lib2to3\grammar.txt
%TEMP%\_mei5642\certifi\cacert.pem
%TEMP%\_mei5642\base_library.zip
%TEMP%\_mei5642\include\pyconfig.h
%TEMP%\_mei5642\win32wnet.pyd
%TEMP%\_mei5642\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei5642\win32ui.pyd
%TEMP%\_mei5642\win32pdh.pyd
%TEMP%\_mei5642\win32crypt.pyd
%TEMP%\_mei5642\win32com\shell\shell.pyd
%TEMP%\_mei5642\win32clipboard.pyd
%TEMP%\_mei5642\win32api.pyd
%TEMP%\_mei5642\unicodedata.pyd
%TEMP%\_mei5642\ucrtbase.dll
%TEMP%\_mei5642\sqlite3.dll
%TEMP%\_mei5642\select.pyd
%TEMP%\_mei5642\pywintypes37.dll
%TEMP%\_mei5642\pyexpat.pyd
%TEMP%\_mei5642\python37.dll
%TEMP%\_mei5642\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei5642\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei5642\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei5642\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei5642\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei5642\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei5642\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei5642\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei5642\_win32sysloader.pyd
%TEMP%\_mei5642\_ssl.pyd
%TEMP%\_mei5642\_sqlite3.pyd
%TEMP%\_mei5642\_socket.pyd
%TEMP%\_mei5642\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei5642\_queue.pyd
%TEMP%\_mei5642\_multiprocessing.pyd
%TEMP%\_mei5642\_lzma.pyd
%TEMP%\_mei5642\_hashlib.pyd
%TEMP%\_mei5642\_elementtree.pyd
%TEMP%\_mei5642\_distutils_findvs.pyd
%TEMP%\_mei5642\_decimal.pyd
%TEMP%\_mei5642\_ctypes.pyd
%TEMP%\_mei5642\_contextvars.pyd
%TEMP%\_mei5642\_bz2.pyd
%TEMP%\_mei5642\vcruntime140.dll
%TEMP%\_mei5642\_portaudio.cp37-win_amd64.pyd
%TEMP%\_mei5642\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei5642\api-ms-win-crt-multibyte-l1-1-0.dll
%TEMP%\_mei5642\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei5642\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei5642\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei5642\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei5642\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei5642\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei5642\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei5642\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei5642\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei5642\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei5642\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei5642\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei5642\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei5642\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei5642\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei5642\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei5642\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei5642\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei5642\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei5642\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei5642\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei5642\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei5642\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei5642\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\tmpxq3ub0cy\gen_py\dicts.dat