Trojan.MulDrop17.49642

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\c4c4c32985f3b74f9e9388053d8533f6.tmp
<Current directory>\$dpx$.tmp\2870481c719ff24b93ec4d1c619627c2.tmp
<Current directory>\$dpx$.tmp\44476fa40e8ff247825e850a0d1880b0.tmp
<Current directory>\$dpx$.tmp\fabda10c545b4240858a91189bfaa8fd.tmp
<Current directory>\$dpx$.tmp\3958b2269a4e144c8a8821259e5d906c.tmp
<Current directory>\$dpx$.tmp\fddf1221ed9f2a4a98c84af5e4572fdd.tmp
<Current directory>\$dpx$.tmp\1313359e5b1d9c4a964f5c83bb35e855.tmp
<Current directory>\$dpx$.tmp\54cb9a0268b60448b5e7e2d7e8bd49b9.tmp
<Current directory>\$dpx$.tmp\ed72667495c26d4e824e951d0d29eff7.tmp
<Current directory>\$dpx$.tmp\97abc16f4c33314182a1d7aeac8749fd.tmp
<Current directory>\$dpx$.tmp\e71be5c8fb336c4cb4c03a1e1b089b83.tmp
<Current directory>\$dpx$.tmp\a63f83eb72388f4d93b2454bdd1598d3.tmp
<Current directory>\$dpx$.tmp\4a032183c290434882e6308f08857f97.tmp
<Current directory>\$dpx$.tmp\28a7d777b1f7cc4ea83bec96b50ab2e2.tmp
<Current directory>\$dpx$.tmp\854642d0bcc4b94ebf44598a9c5aedfc.tmp
<Current directory>\$dpx$.tmp\7ecc7fbf6e2ec14fb4f34f570b36eafb.tmp
<Current directory>\$dpx$.tmp\6858a883439ff1458b71a67b62a3ae9b.tmp
<Current directory>\$dpx$.tmp\be6eb51b3f7d5d49b975d3613ea8d8d8.tmp
<Current directory>\$dpx$.tmp\e480a81c43ca134a99a575919a6eb21a.tmp
<Current directory>\$dpx$.tmp\caff7dab85a27f46af0609212a707b84.tmp
<Current directory>\$dpx$.tmp\2ef665dbbd7cb147b45134cadbb7f1a4.tmp
<Current directory>\$dpx$.tmp\c0cc276c3902e645bf508c8694ed5fc1.tmp
<Current directory>\$dpx$.tmp\3b6e5e51cfb9dd4a8282f71234b8c8a4.tmp
<Current directory>\$dpx$.tmp\77eded0d81c359469329a362089216c9.tmp
<Current directory>\$dpx$.tmp\7e464ab86f9a8145a4f10116f100e2a7.tmp
<Current directory>\$dpx$.tmp\abb15b4dcc2cc24d9a9fb981c712d920.tmp
<Current directory>\$dpx$.tmp\627b2e0b975f1c4b8f121d9ffe26d7ca.tmp
<Current directory>\$dpx$.tmp\30ff450c8afb24479217f6c32d443d47.tmp
<Current directory>\$dpx$.tmp\4ad7379b595842469df532d31ddea563.tmp
<Current directory>\$dpx$.tmp\c4ca8aaaa0717048a7e88cd8b1846fc5.tmp
<Current directory>\$dpx$.tmp\dc6b8b7c6280f6469ed43b329c67d06a.tmp
<Current directory>\$dpx$.tmp\40332e16f3e3dc44a08a102d4a65d08d.tmp
<Current directory>\$dpx$.tmp\b189e56e9208ec489290a6052ece03ca.tmp
<Current directory>\$dpx$.tmp\15ab244c8e8db94db5b00af0c10b6a8f.tmp
<Current directory>\$dpx$.tmp\c9d6e99077e3fc44a355389e5416fb2b.tmp
<Current directory>\$dpx$.tmp\ba3bbcd081507447a1cd0e666aed7f82.tmp
<Current directory>\$dpx$.tmp\441739c4278aa84787ec4d314b6e1b76.tmp
<Current directory>\$dpx$.tmp\9a5b0cccbebda14e87b153dc55a4e6cf.tmp
<Current directory>\$dpx$.tmp\10ea9e2b8696e241a5c64e0a370d52ad.tmp
<Current directory>\$dpx$.tmp\b54e1ab577607e45bff7f87538a1b813.tmp
<Current directory>\$dpx$.tmp\fd1e18610cbe004a8711f8d525f1b1cb.tmp
<Current directory>\$dpx$.tmp\6e59debdfd19194ca39eb79cb982bfc0.tmp
<Current directory>\$dpx$.tmp\1a12df72d3457d49999737c128feb276.tmp
<Current directory>\$dpx$.tmp\44e0b6326bad09498d9d95aec872fe1e.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\77eded0d81c359469329a362089216c9.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\44476fa40e8ff247825e850a0d1880b0.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fabda10c545b4240858a91189bfaa8fd.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3958b2269a4e144c8a8821259e5d906c.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fddf1221ed9f2a4a98c84af5e4572fdd.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1313359e5b1d9c4a964f5c83bb35e855.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\54cb9a0268b60448b5e7e2d7e8bd49b9.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ed72667495c26d4e824e951d0d29eff7.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c4c4c32985f3b74f9e9388053d8533f6.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2870481c719ff24b93ec4d1c619627c2.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\97abc16f4c33314182a1d7aeac8749fd.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4a032183c290434882e6308f08857f97.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\28a7d777b1f7cc4ea83bec96b50ab2e2.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\854642d0bcc4b94ebf44598a9c5aedfc.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7ecc7fbf6e2ec14fb4f34f570b36eafb.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6858a883439ff1458b71a67b62a3ae9b.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\be6eb51b3f7d5d49b975d3613ea8d8d8.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\e480a81c43ca134a99a575919a6eb21a.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\e71be5c8fb336c4cb4c03a1e1b089b83.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a63f83eb72388f4d93b2454bdd1598d3.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\caff7dab85a27f46af0609212a707b84.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c0cc276c3902e645bf508c8694ed5fc1.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\1a12df72d3457d49999737c128feb276.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\abb15b4dcc2cc24d9a9fb981c712d920.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\627b2e0b975f1c4b8f121d9ffe26d7ca.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\30ff450c8afb24479217f6c32d443d47.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4ad7379b595842469df532d31ddea563.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\c4ca8aaaa0717048a7e88cd8b1846fc5.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\dc6b8b7c6280f6469ed43b329c67d06a.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\40332e16f3e3dc44a08a102d4a65d08d.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b189e56e9208ec489290a6052ece03ca.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7e464ab86f9a8145a4f10116f100e2a7.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\15ab244c8e8db94db5b00af0c10b6a8f.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ba3bbcd081507447a1cd0e666aed7f82.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\441739c4278aa84787ec4d314b6e1b76.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9a5b0cccbebda14e87b153dc55a4e6cf.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\10ea9e2b8696e241a5c64e0a370d52ad.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b54e1ab577607e45bff7f87538a1b813.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\fd1e18610cbe004a8711f8d525f1b1cb.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6e59debdfd19194ca39eb79cb982bfc0.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3b6e5e51cfb9dd4a8282f71234b8c8a4.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c9d6e99077e3fc44a355389e5416fb2b.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\2ef665dbbd7cb147b45134cadbb7f1a4.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\44e0b6326bad09498d9d95aec872fe1e.tmp to <Current directory>\vcruntime140.dll

Network activity

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней