Trojan.MulDrop42.58936

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\coffee_3404_134346287797180914\main.dll
%TEMP%\coffee_3404_134346287797180914\coffee_logo.ico
%TEMP%\coffee_3404_134346287797180914\nexus_logo.ico
%TEMP%\coffee_3404_134346287797180914\_bz2.pyd
%TEMP%\coffee_3404_134346287797180914\_ctypes.pyd
%TEMP%\coffee_3404_134346287797180914\_decimal.pyd
%TEMP%\coffee_3404_134346287797180914\_hashlib.pyd
%TEMP%\coffee_3404_134346287797180914\_lzma.pyd
%TEMP%\coffee_3404_134346287797180914\_socket.pyd
%TEMP%\coffee_3404_134346287797180914\_sqlite3.pyd
%TEMP%\coffee_3404_134346287797180914\_ssl.pyd
%TEMP%\coffee_3404_134346287797180914\_uuid.pyd
%TEMP%\coffee_3404_134346287797180914\_wmi.pyd
%TEMP%\coffee_3404_134346287797180914\_zstd.pyd
%TEMP%\coffee_3404_134346287797180914\gaming_hub.dll
%TEMP%\coffee_3404_134346287797180914\libcrypto-3.dll
%TEMP%\coffee_3404_134346287797180914\libffi-8.dll
%TEMP%\coffee_3404_134346287797180914\libssl-3.dll
%TEMP%\coffee_3404_134346287797180914\msvcp140.dll
%TEMP%\coffee_3404_134346287797180914\msvcp140_1.dll
%TEMP%\coffee_3404_134346287797180914\msvcp140_2.dll
%TEMP%\coffee_3404_134346287797180914\nexus_input.dll
%TEMP%\coffee_3404_134346287797180914\nexus_license.dll
%TEMP%\coffee_3404_134346287797180914\nexus_macro.dll
%TEMP%\coffee_3404_134346287797180914\nexus_presets.dll
%TEMP%\coffee_3404_134346287797180914\nexus_recorder.dll
%TEMP%\coffee_3404_134346287797180914\nexus_socd.dll
%TEMP%\coffee_3404_134346287797180914\pyside6.abi3.dll
%TEMP%\coffee_3404_134346287797180914\python3.dll
%TEMP%\coffee_3404_134346287797180914\python314.dll
%TEMP%\coffee_3404_134346287797180914\qt6core.dll
%TEMP%\coffee_3404_134346287797180914\qt6gui.dll
%TEMP%\coffee_3404_134346287797180914\qt6network.dll
%TEMP%\coffee_3404_134346287797180914\qt6pdf.dll
%TEMP%\coffee_3404_134346287797180914\qt6svg.dll
%TEMP%\coffee_3404_134346287797180914\qt6widgets.dll
%TEMP%\coffee_3404_134346287797180914\select.pyd
%TEMP%\coffee_3404_134346287797180914\shiboken6.abi3.dll
%TEMP%\coffee_3404_134346287797180914\sqlite3.dll
%TEMP%\coffee_3404_134346287797180914\unicodedata.pyd
%TEMP%\coffee_3404_134346287797180914\vcruntime140.dll
%TEMP%\coffee_3404_134346287797180914\vcruntime140_1.dll
%TEMP%\coffee_3404_134346287797180914\pyside6\qtcore.pyd
%TEMP%\coffee_3404_134346287797180914\pyside6\qtgui.pyd
%TEMP%\coffee_3404_134346287797180914\pyside6\qtnetwork.pyd
%TEMP%\coffee_3404_134346287797180914\pyside6\qtwidgets.pyd
%TEMP%\coffee_3404_134346287797180914\pyside6\qt-plugins\iconengines\qsvgicon.dll
%TEMP%\coffee_3404_134346287797180914\pyside6\qt-plugins\imageformats\qgif.dll
%TEMP%\coffee_3404_134346287797180914\pyside6\qt-plugins\imageformats\qicns.dll
%TEMP%\coffee_3404_134346287797180914\pyside6\qt-plugins\imageformats\qico.dll
%TEMP%\coffee_3404_134346287797180914\pyside6\qt-plugins\imageformats\qjpeg.dll
%TEMP%\coffee_3404_134346287797180914\pyside6\qt-plugins\imageformats\qpdf.dll
%TEMP%\coffee_3404_134346287797180914\pyside6\qt-plugins\imageformats\qsvg.dll
%TEMP%\coffee_3404_134346287797180914\pyside6\qt-plugins\imageformats\qtga.dll
%TEMP%\coffee_3404_134346287797180914\pyside6\qt-plugins\imageformats\qtiff.dll
%TEMP%\coffee_3404_134346287797180914\pyside6\qt-plugins\imageformats\qwbmp.dll
%TEMP%\coffee_3404_134346287797180914\pyside6\qt-plugins\imageformats\qwebp.dll
%TEMP%\coffee_3404_134346287797180914\pyside6\qt-plugins\platforms\qdirect2d.dll
%TEMP%\coffee_3404_134346287797180914\pyside6\qt-plugins\platforms\qminimal.dll
%TEMP%\coffee_3404_134346287797180914\pyside6\qt-plugins\platforms\qoffscreen.dll
%TEMP%\coffee_3404_134346287797180914\pyside6\qt-plugins\platforms\qwindows.dll
%TEMP%\coffee_3404_134346287797180914\pyside6\qt-plugins\styles\qmodernwindowsstyle.dll
%TEMP%\coffee_3404_134346287797180914\pyside6\qt-plugins\tls\qcertonlybackend.dll
%TEMP%\coffee_3404_134346287797180914\pyside6\qt-plugins\tls\qopensslbackend.dll
%TEMP%\coffee_3404_134346287797180914\pyside6\qt-plugins\tls\qschannelbackend.dll
%TEMP%\coffee_3404_134346287797180914\shiboken6\shiboken.pyd
%TEMP%\coffee_3404_134346287797180914\shiboken6\msvcp140.dll
%TEMP%\coffee_3404_134346287797180914\shiboken6\msvcp140_1.dll
%TEMP%\coffee_3404_134346287797180914\shiboken6\msvcp140_2.dll
%TEMP%\coffee_3404_134346287797180914\shiboken6\msvcp140_codecvt_ids.dll
%LOCALAPPDATA%\coffee\running.json
%LOCALAPPDATA%\nexusplus\nexus_plus.db-journal
%LOCALAPPDATA%\nexusplus\nexus_plus.db