Trojan.MulDrop33.44052

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'SystemHostMonitor' = '%ALLUSERSPROFILE%\SystemHost\svchost_task.exe'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\_mei13962\pil\_avif.cp311-win_amd64.pyd
%TEMP%\_mei13962\pil\_imaging.cp311-win_amd64.pyd
%TEMP%\_mei13962\pil\_imagingcms.cp311-win_amd64.pyd
%TEMP%\_mei13962\pil\_imagingmath.cp311-win_amd64.pyd
%TEMP%\_mei13962\pil\_imagingtk.cp311-win_amd64.pyd
%TEMP%\_mei13962\pil\_webp.cp311-win_amd64.pyd
%TEMP%\_mei13962\vcruntime140.dll
%TEMP%\_mei13962\vcruntime140_1.dll
%TEMP%\_mei13962\_asyncio.pyd
%TEMP%\_mei13962\_bz2.pyd
%TEMP%\_mei13962\_ctypes.pyd
%TEMP%\_mei13962\_decimal.pyd
%TEMP%\_mei13962\_elementtree.pyd
%TEMP%\_mei13962\_hashlib.pyd
%TEMP%\_mei13962\_lzma.pyd
%TEMP%\_mei13962\_multiprocessing.pyd
%TEMP%\_mei13962\_overlapped.pyd
%TEMP%\_mei13962\_queue.pyd
%TEMP%\_mei13962\_socket.pyd
%TEMP%\_mei13962\_ssl.pyd
%TEMP%\_mei13962\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-core-fibers-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei13962\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei13962\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei13962\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei13962\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei13962\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-crt-private-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei13962\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei13962\base_library.zip
%TEMP%\_mei13962\certifi\cacert.pem
%TEMP%\_mei13962\charset_normalizer\md.cp311-win_amd64.pyd
%TEMP%\_mei13962\charset_normalizer\md__mypyc.cp311-win_amd64.pyd
%TEMP%\_mei13962\libcrypto-3.dll
%TEMP%\_mei13962\libffi-8.dll
%TEMP%\_mei13962\libssl-3.dll
%TEMP%\_mei13962\numpy-2.3.4.dist-info\delvewheel
%TEMP%\_mei13962\numpy-2.3.4.dist-info\installer
%TEMP%\_mei13962\numpy-2.3.4.dist-info\license.txt
%TEMP%\_mei13962\numpy-2.3.4.dist-info\metadata
%TEMP%\_mei13962\numpy-2.3.4.dist-info\record
%TEMP%\_mei13962\numpy-2.3.4.dist-info\wheel
%TEMP%\_mei13962\numpy-2.3.4.dist-info\entry_points.txt
%TEMP%\_mei13962\numpy.libs\libscipy_openblas64_-860d95b1c38e637ce4509f5fa24fbf2a.dll
%TEMP%\_mei13962\numpy.libs\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
%TEMP%\_mei13962\numpy\_core\_multiarray_tests.cp311-win_amd64.pyd
%TEMP%\_mei13962\numpy\_core\_multiarray_umath.cp311-win_amd64.pyd
%TEMP%\_mei13962\numpy\fft\_pocketfft_umath.cp311-win_amd64.pyd
%TEMP%\_mei13962\numpy\linalg\_umath_linalg.cp311-win_amd64.pyd
%TEMP%\_mei13962\numpy\random\_bounded_integers.cp311-win_amd64.pyd
%TEMP%\_mei13962\numpy\random\_common.cp311-win_amd64.pyd
%TEMP%\_mei13962\numpy\random\_generator.cp311-win_amd64.pyd
%TEMP%\_mei13962\numpy\random\_mt19937.cp311-win_amd64.pyd
%TEMP%\_mei13962\numpy\random\_pcg64.cp311-win_amd64.pyd
%TEMP%\_mei13962\numpy\random\_philox.cp311-win_amd64.pyd
%TEMP%\_mei13962\numpy\random\_sfc64.cp311-win_amd64.pyd
%TEMP%\_mei13962\numpy\random\bit_generator.cp311-win_amd64.pyd
%TEMP%\_mei13962\numpy\random\mtrand.cp311-win_amd64.pyd
%TEMP%\_mei13962\psutil\_psutil_windows.pyd
%TEMP%\_mei13962\pyexpat.pyd
%TEMP%\_mei13962\python3.dll
%TEMP%\_mei13962\python311.dll
%TEMP%\_mei13962\pywin32_system32\pywintypes311.dll
%TEMP%\_mei13962\select.pyd
%TEMP%\_mei13962\ucrtbase.dll
%TEMP%\_mei13962\unicodedata.pyd
%TEMP%\_mei13962\win32\win32pdh.pyd
%TEMP%\_mei13962\yaml\_yaml.cp311-win_amd64.pyd
%TEMP%\_mei13962\zstandard\_cffi.cp311-win_amd64.pyd
%TEMP%\_mei13962\zstandard\backend_c.cp311-win_amd64.pyd
%ALLUSERSPROFILE%\systemhost\svchost_task.exe