Trojan.DownLoader50.21515

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Classes\comtress\shell\open\command] '' = '"<Full path to file>" "%1"'

Modifies file system

Creates the following files

%TEMP%\_mei21082\vcruntime140.dll
%TEMP%\_mei21082\vcruntime140_1.dll
%TEMP%\_mei21082\_asyncio.pyd
%TEMP%\_mei21082\_bz2.pyd
%TEMP%\_mei21082\_cffi_backend.cp313-win_amd64.pyd
%TEMP%\_mei21082\_ctypes.pyd
%TEMP%\_mei21082\_decimal.pyd
%TEMP%\_mei21082\_elementtree.pyd
%TEMP%\_mei21082\_hashlib.pyd
%TEMP%\_mei21082\_lzma.pyd
%TEMP%\_mei21082\_multiprocessing.pyd
%TEMP%\_mei21082\_overlapped.pyd
%TEMP%\_mei21082\_queue.pyd
%TEMP%\_mei21082\_socket.pyd
%TEMP%\_mei21082\_ssl.pyd
%TEMP%\_mei21082\_uuid.pyd
%TEMP%\_mei21082\_wmi.pyd
%TEMP%\_mei21082\aiohttp\_http_parser.cp313-win_amd64.pyd
%TEMP%\_mei21082\aiohttp\_http_writer.cp313-win_amd64.pyd
%TEMP%\_mei21082\aiohttp\_websocket\mask.cp313-win_amd64.pyd
%TEMP%\_mei21082\aiohttp\_websocket\reader_c.cp313-win_amd64.pyd
%TEMP%\_mei21082\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-core-fibers-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-core-fibers-l1-1-1.dll
%TEMP%\_mei21082\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei21082\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei21082\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-core-kernel32-legacy-l1-1-1.dll
%TEMP%\_mei21082\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei21082\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei21082\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei21082\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-core-sysinfo-l1-2-0.dll
%TEMP%\_mei21082\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei21082\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei21082\attrs-25.4.0.dist-info\installer
%TEMP%\_mei21082\attrs-25.4.0.dist-info\metadata
%TEMP%\_mei21082\attrs-25.4.0.dist-info\record
%TEMP%\_mei21082\attrs-25.4.0.dist-info\wheel
%TEMP%\_mei21082\attrs-25.4.0.dist-info\licenses\license
%TEMP%\_mei21082\base_library.zip
%TEMP%\_mei21082\certifi\cacert.pem
%TEMP%\_mei21082\clr_loader\ffi\dlls\amd64\clrloader.dll
%TEMP%\_mei21082\clr_loader\ffi\dlls\x86\clrloader.dll
%TEMP%\_mei21082\frozenlist\_frozenlist.cp313-win_amd64.pyd
%TEMP%\_mei21082\gui\favicon.ico
%TEMP%\_mei21082\gui\index.html
%TEMP%\_mei21082\gui\tc2.png
%TEMP%\_mei21082\gui\update.html
%TEMP%\_mei21082\libcrypto-3.dll
%TEMP%\_mei21082\libffi-8.dll
%TEMP%\_mei21082\libssl-3.dll
%TEMP%\_mei21082\multidict\_multidict.cp313-win_amd64.pyd
%TEMP%\_mei21082\propcache\_helpers_c.cp313-win_amd64.pyd
%TEMP%\_mei21082\psutil\_psutil_windows.pyd
%TEMP%\_mei21082\pyexpat.pyd
%TEMP%\_mei21082\python3.dll
%TEMP%\_mei21082\python313.dll
%TEMP%\_mei21082\pythonnet\runtime\python.runtime.dll
%TEMP%\_mei21082\select.pyd
%TEMP%\_mei21082\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\installer
%TEMP%\_mei21082\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\license
%TEMP%\_mei21082\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\metadata
%TEMP%\_mei21082\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\record
%TEMP%\_mei21082\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\wheel
%TEMP%\_mei21082\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt
%TEMP%\_mei21082\setuptools\_vendor\jaraco\text\lorem ipsum.txt
%TEMP%\_mei21082\ucrtbase.dll
%TEMP%\_mei21082\unicodedata.pyd
%TEMP%\_mei21082\webview\js\api.js
%TEMP%\_mei21082\webview\js\customize.js
%TEMP%\_mei21082\webview\js\finish.js
%TEMP%\_mei21082\webview\js\lib\dom_json.js
%TEMP%\_mei21082\webview\js\lib\polyfill.js
%TEMP%\_mei21082\webview\js\state.js
%TEMP%\_mei21082\webview\lib\microsoft.web.webview2.core.dll
%TEMP%\_mei21082\webview\lib\microsoft.web.webview2.winforms.dll
%TEMP%\_mei21082\webview\lib\webbrowserinterop.x64.dll
%TEMP%\_mei21082\webview\lib\webbrowserinterop.x86.dll
%TEMP%\_mei21082\webview\lib\pywebview-android.jar
%TEMP%\_mei21082\webview\lib\runtimes\win-arm64\native\webview2loader.dll
%TEMP%\_mei21082\webview\lib\runtimes\win-x64\native\webview2loader.dll
%TEMP%\_mei21082\webview\lib\runtimes\win-x86\native\webview2loader.dll
%TEMP%\_mei21082\yarl\_quoting_c.cp313-win_amd64.pyd
nul
%LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
%LOCALAPPDATA%\tc2launcher\settings.json
%LOCALAPPDATA%\tc2launcher\tc2_launcher_log.txt
%TEMP%\48d576t5