Trojan.DownLoader32.51492

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\66d99f0fe063ac49a8c90e74a0809bd9.tmp
<Current directory>\$dpx$.tmp\8dd83c9f7991764ea028079d37f315bd.tmp
<Current directory>\$dpx$.tmp\442c6c05ce5b144f926c8cda4ffa84c6.tmp
<Current directory>\$dpx$.tmp\66a4c7ec2d1da84c941f118cc20a9ca4.tmp
<Current directory>\$dpx$.tmp\4d5d9fd9c9435847ad10803953821b7f.tmp
<Current directory>\$dpx$.tmp\d64d1632cb7d8548a21cef169602b1e4.tmp
<Current directory>\$dpx$.tmp\0c8d1b430885d8459982198e99b94ee0.tmp
<Current directory>\$dpx$.tmp\8ed4d067bd48564282a482ecf74f88ef.tmp
<Current directory>\$dpx$.tmp\714e748d9c27594d9ffaa087e26ac313.tmp
<Current directory>\$dpx$.tmp\36c193683c876844bd7c21a552e15a3d.tmp
<Current directory>\$dpx$.tmp\dbc6b2b19f3ec44fb88aeb8c3bb61962.tmp
<Current directory>\$dpx$.tmp\e07165bed1a6084ea79c3b43bbdf919c.tmp
<Current directory>\$dpx$.tmp\c92e834a4c980f42a307ec31bf81e22b.tmp
<Current directory>\$dpx$.tmp\1517c32d9989d540b97f3793b8e798f5.tmp
<Current directory>\$dpx$.tmp\0c37855675a11848be61997752fff99b.tmp
<Current directory>\$dpx$.tmp\85f9d340be65b84986270024fccac167.tmp
<Current directory>\$dpx$.tmp\0e204f8c646dbd4a84d48355cd7e36e3.tmp
<Current directory>\$dpx$.tmp\2974819abe25ab40ac35bd924beb050d.tmp
<Current directory>\$dpx$.tmp\7801742f67a8854a8a050cf2474aab82.tmp
<Current directory>\$dpx$.tmp\7990f0847ce1b44989122caf9730d91f.tmp
<Current directory>\$dpx$.tmp\6cd20953511f3f4f9e18362bf49dc6be.tmp
<Current directory>\$dpx$.tmp\357f2157201df74a898ee52172244340.tmp
<Current directory>\$dpx$.tmp\1bbefd919375ee40a6388a589714f64e.tmp
<Current directory>\$dpx$.tmp\8a068dc952d887469ec989997026ed94.tmp
<Current directory>\$dpx$.tmp\a4d566ac04fcd34e8657786c5be71236.tmp
<Current directory>\$dpx$.tmp\773adf63fcda45419c7dca7889fc013a.tmp
<Current directory>\$dpx$.tmp\1d187bf72df39f49bc5031e243f56d78.tmp
<Current directory>\$dpx$.tmp\d70c711a11c419439bb9ecedff31f6a4.tmp
<Current directory>\$dpx$.tmp\5ffe3f33d6a8a04a9cb3e2c5f2e9f7f7.tmp
<Current directory>\$dpx$.tmp\318bdff5181c2448b76b3bb40c70ed0d.tmp
<Current directory>\$dpx$.tmp\b38088a14c865640888691ebdd2e3991.tmp
<Current directory>\$dpx$.tmp\b5b3021a7c46ff408909819572df661d.tmp
<Current directory>\$dpx$.tmp\68a4d414e8871f40891106b7e4f27cab.tmp
<Current directory>\$dpx$.tmp\8730d2fa17d4124bbbfcbed5a35634a0.tmp
<Current directory>\$dpx$.tmp\b79811f865c64945823cc7315b9257ee.tmp
<Current directory>\$dpx$.tmp\94be7fa39687044f8d412d584e546a39.tmp
<Current directory>\$dpx$.tmp\ea54f4664f8be54e94afbb5948465c66.tmp
<Current directory>\$dpx$.tmp\270763bf308c354bbd04f6d31d9943ce.tmp
<Current directory>\$dpx$.tmp\a43611cc074aa24c8a78eeec32806392.tmp
<Current directory>\$dpx$.tmp\b5d0dce66f8edb4a942fd2d8c988452a.tmp
<Current directory>\$dpx$.tmp\e8f35819d370914fa9ee6aade29a13f9.tmp
<Current directory>\$dpx$.tmp\67987e43457c674c98dcc344caf1c11b.tmp
<Current directory>\$dpx$.tmp\347dffe60e93cc41a99161dd43f8f1be.tmp
<Current directory>\$dpx$.tmp\d204054deca6dc448a4b8ab1a516ec4f.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\8a068dc952d887469ec989997026ed94.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\442c6c05ce5b144f926c8cda4ffa84c6.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\66a4c7ec2d1da84c941f118cc20a9ca4.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4d5d9fd9c9435847ad10803953821b7f.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d64d1632cb7d8548a21cef169602b1e4.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0c8d1b430885d8459982198e99b94ee0.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8ed4d067bd48564282a482ecf74f88ef.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\714e748d9c27594d9ffaa087e26ac313.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\66d99f0fe063ac49a8c90e74a0809bd9.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8dd83c9f7991764ea028079d37f315bd.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\36c193683c876844bd7c21a552e15a3d.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c92e834a4c980f42a307ec31bf81e22b.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1517c32d9989d540b97f3793b8e798f5.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0c37855675a11848be61997752fff99b.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\85f9d340be65b84986270024fccac167.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0e204f8c646dbd4a84d48355cd7e36e3.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2974819abe25ab40ac35bd924beb050d.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\7801742f67a8854a8a050cf2474aab82.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\dbc6b2b19f3ec44fb88aeb8c3bb61962.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e07165bed1a6084ea79c3b43bbdf919c.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7990f0847ce1b44989122caf9730d91f.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\357f2157201df74a898ee52172244340.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\347dffe60e93cc41a99161dd43f8f1be.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\773adf63fcda45419c7dca7889fc013a.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1d187bf72df39f49bc5031e243f56d78.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d70c711a11c419439bb9ecedff31f6a4.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5ffe3f33d6a8a04a9cb3e2c5f2e9f7f7.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\318bdff5181c2448b76b3bb40c70ed0d.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\b38088a14c865640888691ebdd2e3991.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b5b3021a7c46ff408909819572df661d.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\68a4d414e8871f40891106b7e4f27cab.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a4d566ac04fcd34e8657786c5be71236.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8730d2fa17d4124bbbfcbed5a35634a0.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\94be7fa39687044f8d412d584e546a39.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ea54f4664f8be54e94afbb5948465c66.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\270763bf308c354bbd04f6d31d9943ce.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a43611cc074aa24c8a78eeec32806392.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b5d0dce66f8edb4a942fd2d8c988452a.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\e8f35819d370914fa9ee6aade29a13f9.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\67987e43457c674c98dcc344caf1c11b.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1bbefd919375ee40a6388a589714f64e.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b79811f865c64945823cc7315b9257ee.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\6cd20953511f3f4f9e18362bf49dc6be.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\d204054deca6dc448a4b8ab1a516ec4f.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443
'lp##.haqo.net':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней