Trojan.MulDrop11.22570

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\4c28bca0fb36244588865c88e709de0a.tmp
<Current directory>\$dpx$.tmp\bed753ed18049d4f8783a3c503d484dd.tmp
<Current directory>\$dpx$.tmp\4d32ba853bd1544b846211d5b0b32400.tmp
<Current directory>\$dpx$.tmp\ca66a5e43b71a44594914e87db34a2b1.tmp
<Current directory>\$dpx$.tmp\cad137458283384fb02fcd899261f0cc.tmp
<Current directory>\$dpx$.tmp\e1f69144dfadea44911e5e5ac96376e1.tmp
<Current directory>\$dpx$.tmp\f42b34112194054792915695c8fe1d00.tmp
<Current directory>\$dpx$.tmp\abb60407c4beba43946bb2722cfe36bf.tmp
<Current directory>\$dpx$.tmp\70ba084896264c43a3589a1eaf2902b7.tmp
<Current directory>\$dpx$.tmp\6f03ce46e667d64c91b70cd0caf6d3f4.tmp
<Current directory>\$dpx$.tmp\b54d12bd78c40149a2b18747d8c03d01.tmp
<Current directory>\$dpx$.tmp\0336539b5223944ea2df25dd0ee06f93.tmp
<Current directory>\$dpx$.tmp\f2107657919e2c4993ebae41a3b56027.tmp
<Current directory>\$dpx$.tmp\e082a279a90ee647be84ea69f03de972.tmp
<Current directory>\$dpx$.tmp\90367c86d9d1c4489fb97a408092acc0.tmp
<Current directory>\$dpx$.tmp\17b00cd2f0711c47807b779a9912483d.tmp
<Current directory>\$dpx$.tmp\04b2cc72029985488bc96cc9990e23d3.tmp
<Current directory>\$dpx$.tmp\a8139bde9d2c004b8aaf837f902e5310.tmp
<Current directory>\$dpx$.tmp\5871c5441b1c094a998bd60c7d99d4fd.tmp
<Current directory>\$dpx$.tmp\202443b7a10c424b8eaef40bb7142380.tmp
<Current directory>\$dpx$.tmp\c2f428faae738e44ad41eea830e02216.tmp
<Current directory>\$dpx$.tmp\9f9510f6a303a94d8e5918505767553f.tmp
<Current directory>\$dpx$.tmp\ab7eeb44c267ed41957c89974ae01b63.tmp
<Current directory>\$dpx$.tmp\68d8d58eec11a04d93f1e1027e2a9015.tmp
<Current directory>\$dpx$.tmp\db73e379cd2a9340b6538a7d9b12dc34.tmp
<Current directory>\$dpx$.tmp\0efe57beedc7854b9679ecd74bfe9e0c.tmp
<Current directory>\$dpx$.tmp\7d084de9fd528d4f959aefc0499c21c2.tmp
<Current directory>\$dpx$.tmp\3da8800cda17574482b5175a6d1f910a.tmp
<Current directory>\$dpx$.tmp\664340fe4fc34d4ea79fcc07809a6ce8.tmp
<Current directory>\$dpx$.tmp\3147eef8fca8b14eaef25d4b5d822cc3.tmp
<Current directory>\$dpx$.tmp\611b770ea3e68943b6e0229903864d87.tmp
<Current directory>\$dpx$.tmp\afcae52ea24c3a44afad58822d35dd86.tmp
<Current directory>\$dpx$.tmp\5b860f111cfddd48b74cb07e0eb593f7.tmp
<Current directory>\$dpx$.tmp\8903466168c8154f8faa1cd02e8d3e75.tmp
<Current directory>\$dpx$.tmp\f4a40bec9436dd4087a7138871c0fa8d.tmp
<Current directory>\$dpx$.tmp\4907458829328e4495627123eb65e0d9.tmp
<Current directory>\$dpx$.tmp\d4c2e9536a316f4f9cac184fed3a071e.tmp
<Current directory>\$dpx$.tmp\8881036add14d446b71a4daac68ae69f.tmp
<Current directory>\$dpx$.tmp\319ad636c8f2904ab81d3db2cc9d4585.tmp
<Current directory>\$dpx$.tmp\ae941284a62f854b93ab99480363db40.tmp
<Current directory>\$dpx$.tmp\c4dbfb5e46719744829913a6909af7ce.tmp
<Current directory>\$dpx$.tmp\99652152cbadd3469652b0801e264ed5.tmp
<Current directory>\$dpx$.tmp\5229904b7207fa4db5b1fb72257c7b7f.tmp
<Current directory>\$dpx$.tmp\544446a7cddae24d88e6231816865c14.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\68d8d58eec11a04d93f1e1027e2a9015.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4d32ba853bd1544b846211d5b0b32400.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ca66a5e43b71a44594914e87db34a2b1.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cad137458283384fb02fcd899261f0cc.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e1f69144dfadea44911e5e5ac96376e1.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f42b34112194054792915695c8fe1d00.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\abb60407c4beba43946bb2722cfe36bf.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\70ba084896264c43a3589a1eaf2902b7.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4c28bca0fb36244588865c88e709de0a.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bed753ed18049d4f8783a3c503d484dd.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6f03ce46e667d64c91b70cd0caf6d3f4.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f2107657919e2c4993ebae41a3b56027.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e082a279a90ee647be84ea69f03de972.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\90367c86d9d1c4489fb97a408092acc0.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\17b00cd2f0711c47807b779a9912483d.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\04b2cc72029985488bc96cc9990e23d3.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a8139bde9d2c004b8aaf837f902e5310.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\5871c5441b1c094a998bd60c7d99d4fd.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\b54d12bd78c40149a2b18747d8c03d01.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0336539b5223944ea2df25dd0ee06f93.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\202443b7a10c424b8eaef40bb7142380.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9f9510f6a303a94d8e5918505767553f.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\5229904b7207fa4db5b1fb72257c7b7f.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0efe57beedc7854b9679ecd74bfe9e0c.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7d084de9fd528d4f959aefc0499c21c2.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3da8800cda17574482b5175a6d1f910a.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\664340fe4fc34d4ea79fcc07809a6ce8.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\3147eef8fca8b14eaef25d4b5d822cc3.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\611b770ea3e68943b6e0229903864d87.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\afcae52ea24c3a44afad58822d35dd86.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5b860f111cfddd48b74cb07e0eb593f7.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\db73e379cd2a9340b6538a7d9b12dc34.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8903466168c8154f8faa1cd02e8d3e75.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4907458829328e4495627123eb65e0d9.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d4c2e9536a316f4f9cac184fed3a071e.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8881036add14d446b71a4daac68ae69f.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\319ad636c8f2904ab81d3db2cc9d4585.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ae941284a62f854b93ab99480363db40.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\c4dbfb5e46719744829913a6909af7ce.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\99652152cbadd3469652b0801e264ed5.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ab7eeb44c267ed41957c89974ae01b63.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f4a40bec9436dd4087a7138871c0fa8d.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\c2f428faae738e44ad41eea830e02216.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\544446a7cddae24d88e6231816865c14.tmp to <Current directory>\vcruntime140.dll

Network activity

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней