Trojan.DownLoader12.52805

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'<LS_APPDATA>\acebaby\local\stubexe\0xFB5412473720ACF7\ace_engine.exe'

Запускает на исполнение:

'<SYSTEM32>\wbem\wmiadap.exe' /R /T
'<SYSTEM32>\route.exe' print
'<SYSTEM32>\netstat.exe' -nr

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\npace_plugin.dll_0xdb4e3be3319897df63975bd95f1169b0.2.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\M2Crypto.__m2crypto.pyd_0x427f0071d838e937730b55852579574d.2.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\sqlite3.dll_0x77098a8a7387de32bc7ecf52b6f41ef7.2.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\python27.dll_0xc22de89ee5456df540456d01e7676fed.2.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\cpyamf.util.pyd_0x21166d20ef8a9f523b292c859236aa34.2.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\cpyamf.amf3.pyd_0x20a5c1d8a4a27fe5481a26d2099ae55f.2.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\LIBEAY32.dll_0xe16a6bc771cb72e443c15751aab5311a.2.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\Crypto.Cipher.AES.pyd_0x6d706762fd3d320ebb95a0f40b854feb.2.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\SSLEAY32.dll_0xcfa4c200f811975766014853eb478d2a.2.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\wx._windows_.pyd_0xa8346a7306d7ffdda4098bde75116a3d.2.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\wx._misc_.pyd_0x41c627ed1818e18b9d4df9f1afbc99f2.2.manifest.__tmp__
<LS_APPDATA>\acebaby\roaming\modified\@APPDATA@\ACEStream\engine\acestream.log
<LS_APPDATA>\acebaby\roaming\meta\@APPDATA@\ACEStream\engine\acestream.log.__meta__.__tmp__
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\wx._controls_.pyd_0x2e27f973c188d0e9788f522ed1891e33.2.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\win32ui.pyd_0xa52d4e8e28b20b0bb1d18563f8f1b245.2.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\wx._gdi_.pyd_0x6cea3ddb8bfde8f495aca9c8148287e7.2.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\wx._core_.pyd_0xd883388fb04560e996684e737a794f2e.2.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\ace_stream.exe_0xe1826678e666890feb7b7783eba86243.1.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\ace_engine.exe_0x7b6cb5c60e549b746fa8deee82c5bb53.1.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\acestreamengine.CoreApp.pyd_0xaf613607adc15f168b2ea1dd62a9bd7e.2.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\acestreamengine.Core.pyd_0x00c5a801d9aa7c49d64258a74a6af92c.2.manifest.__tmp__
<LS_APPDATA>\acebaby\local\stubexe\0xFB5412473720ACF7\ace_engine.exe.__tmp__
<LS_APPDATA>\acebaby\xsandbox.bin.__tmp__
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\ace_console.exe_0x3637122664d2c6d90fde3e83f31ae73f.1.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\_blist.pyd_0x381b3226caafcd7924fb4fa51c552a6c.2.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\acestreamengine.live.pyd_0x72556236e21b7f51eff6b0dc527c020f.2.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\apsw.pyd_0x1247eae76734a6b6c3521f5ba316b199.2.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\acestreamengine.Transport.pyd_0x98e9b90d5f4e78d4c7aa748226411d44.2.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\cpyamf.amf0.pyd_0xed290ce6cddac3103512883752daafec.2.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\bitarray._bitarray.pyd_0x3446057079082f2a3796f113eeeb8d39.2.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\acestreamengine.pycompat.pyd_0xfc4b9a3f81dc0123fb9260f51f232f49.2.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\acestreamengine.node.pyd_0x47194912fdc44a849c14865f624f84c4.2.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\acestreamengine.streamer.pyd_0x494436c7e98936225b288fd8e78a940b.2.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\acestreamengine.pywebrtc.pyd_0xffce1464b28c3d3382a72d8c671987c4.2.manifest.__tmp__

Удаляет следующие файлы:

<SYSTEM32>\wbem\Performance\WmiApRpl.ini

Перемещает следующие файлы:

%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\npace_plugin.dll_0xdb4e3be3319897df63975bd95f1169b0.2.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\npace_plugin.dll_0xdb4e3be3319897df63975bd95f1169b0.2.manifest
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\M2Crypto.__m2crypto.pyd_0x427f0071d838e937730b55852579574d.2.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\M2Crypto.__m2crypto.pyd_0x427f0071d838e937730b55852579574d.2.manifest
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\sqlite3.dll_0x77098a8a7387de32bc7ecf52b6f41ef7.2.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\sqlite3.dll_0x77098a8a7387de32bc7ecf52b6f41ef7.2.manifest
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\python27.dll_0xc22de89ee5456df540456d01e7676fed.2.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\python27.dll_0xc22de89ee5456df540456d01e7676fed.2.manifest
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\cpyamf.util.pyd_0x21166d20ef8a9f523b292c859236aa34.2.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\cpyamf.util.pyd_0x21166d20ef8a9f523b292c859236aa34.2.manifest
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\cpyamf.amf3.pyd_0x20a5c1d8a4a27fe5481a26d2099ae55f.2.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\cpyamf.amf3.pyd_0x20a5c1d8a4a27fe5481a26d2099ae55f.2.manifest
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\LIBEAY32.dll_0xe16a6bc771cb72e443c15751aab5311a.2.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\LIBEAY32.dll_0xe16a6bc771cb72e443c15751aab5311a.2.manifest
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\Crypto.Cipher.AES.pyd_0x6d706762fd3d320ebb95a0f40b854feb.2.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\Crypto.Cipher.AES.pyd_0x6d706762fd3d320ebb95a0f40b854feb.2.manifest
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\wx._misc_.pyd_0x41c627ed1818e18b9d4df9f1afbc99f2.2.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\wx._misc_.pyd_0x41c627ed1818e18b9d4df9f1afbc99f2.2.manifest
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\wx._gdi_.pyd_0x6cea3ddb8bfde8f495aca9c8148287e7.2.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\wx._gdi_.pyd_0x6cea3ddb8bfde8f495aca9c8148287e7.2.manifest
<LS_APPDATA>\acebaby\roaming\meta\@APPDATA@\ACEStream\engine\acestream.log.__meta__.__tmp__ в <LS_APPDATA>\acebaby\roaming\meta\@APPDATA@\ACEStream\engine\acestream.log.__meta__
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\wx._windows_.pyd_0xa8346a7306d7ffdda4098bde75116a3d.2.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\wx._windows_.pyd_0xa8346a7306d7ffdda4098bde75116a3d.2.manifest
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\win32ui.pyd_0xa52d4e8e28b20b0bb1d18563f8f1b245.2.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\win32ui.pyd_0xa52d4e8e28b20b0bb1d18563f8f1b245.2.manifest
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\SSLEAY32.dll_0xcfa4c200f811975766014853eb478d2a.2.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\SSLEAY32.dll_0xcfa4c200f811975766014853eb478d2a.2.manifest
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\wx._core_.pyd_0xd883388fb04560e996684e737a794f2e.2.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\wx._core_.pyd_0xd883388fb04560e996684e737a794f2e.2.manifest
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\wx._controls_.pyd_0x2e27f973c188d0e9788f522ed1891e33.2.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\wx._controls_.pyd_0x2e27f973c188d0e9788f522ed1891e33.2.manifest
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\cpyamf.amf0.pyd_0xed290ce6cddac3103512883752daafec.2.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\cpyamf.amf0.pyd_0xed290ce6cddac3103512883752daafec.2.manifest
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\ace_stream.exe_0xe1826678e666890feb7b7783eba86243.1.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\ace_stream.exe_0xe1826678e666890feb7b7783eba86243.1.manifest
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\ace_engine.exe_0x7b6cb5c60e549b746fa8deee82c5bb53.1.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\ace_engine.exe_0x7b6cb5c60e549b746fa8deee82c5bb53.1.manifest
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\acestreamengine.CoreApp.pyd_0xaf613607adc15f168b2ea1dd62a9bd7e.2.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\acestreamengine.CoreApp.pyd_0xaf613607adc15f168b2ea1dd62a9bd7e.2.manifest
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\acestreamengine.Core.pyd_0x00c5a801d9aa7c49d64258a74a6af92c.2.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\acestreamengine.Core.pyd_0x00c5a801d9aa7c49d64258a74a6af92c.2.manifest
<LS_APPDATA>\acebaby\local\stubexe\0xFB5412473720ACF7\ace_engine.exe.__tmp__ в <LS_APPDATA>\acebaby\local\stubexe\0xFB5412473720ACF7\ace_engine.exe
<LS_APPDATA>\acebaby\xsandbox.bin.__tmp__ в <LS_APPDATA>\acebaby\xsandbox.bin
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\ace_console.exe_0x3637122664d2c6d90fde3e83f31ae73f.1.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\ace_console.exe_0x3637122664d2c6d90fde3e83f31ae73f.1.manifest
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\_blist.pyd_0x381b3226caafcd7924fb4fa51c552a6c.2.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\_blist.pyd_0x381b3226caafcd7924fb4fa51c552a6c.2.manifest
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\acestreamengine.Transport.pyd_0x98e9b90d5f4e78d4c7aa748226411d44.2.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\acestreamengine.Transport.pyd_0x98e9b90d5f4e78d4c7aa748226411d44.2.manifest
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\acestreamengine.streamer.pyd_0x494436c7e98936225b288fd8e78a940b.2.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\acestreamengine.streamer.pyd_0x494436c7e98936225b288fd8e78a940b.2.manifest
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\bitarray._bitarray.pyd_0x3446057079082f2a3796f113eeeb8d39.2.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\bitarray._bitarray.pyd_0x3446057079082f2a3796f113eeeb8d39.2.manifest
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\apsw.pyd_0x1247eae76734a6b6c3521f5ba316b199.2.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\apsw.pyd_0x1247eae76734a6b6c3521f5ba316b199.2.manifest
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\acestreamengine.node.pyd_0x47194912fdc44a849c14865f624f84c4.2.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\acestreamengine.node.pyd_0x47194912fdc44a849c14865f624f84c4.2.manifest
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\acestreamengine.live.pyd_0x72556236e21b7f51eff6b0dc527c020f.2.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\acestreamengine.live.pyd_0x72556236e21b7f51eff6b0dc527c020f.2.manifest
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\acestreamengine.pywebrtc.pyd_0xffce1464b28c3d3382a72d8c671987c4.2.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\acestreamengine.pywebrtc.pyd_0xffce1464b28c3d3382a72d8c671987c4.2.manifest
%TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\acestreamengine.pycompat.pyd_0xfc4b9a3f81dc0123fb9260f51f232f49.2.manifest.__tmp__ в %TEMP%\SPOON\CACHE\0x5ECFC493F2BD0BAC\sxs\Manifests\acestreamengine.pycompat.pyd_0xfc4b9a3f81dc0123fb9260f51f232f49.2.manifest

Сетевая активность:

Подключается к:

'st###.spoon.net':443

UDP:

DNS ASK st###.spoon.net

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней