Trojan.DownLoader32.51493

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\f953f0ec2b147c47b65d0810f794e88a.tmp
<Current directory>\$dpx$.tmp\152b38b26a8ee64fa5f78cef4b8e8b38.tmp
<Current directory>\$dpx$.tmp\6293aab4b64d7b44bc467140d4d977d5.tmp
<Current directory>\$dpx$.tmp\f0b19f3c19835d47ad2f8058d8793941.tmp
<Current directory>\$dpx$.tmp\40d2b2403196704db2b120532b436597.tmp
<Current directory>\$dpx$.tmp\c4d07e1519a98c42ab3cecdcc478e7a1.tmp
<Current directory>\$dpx$.tmp\8117f62fdae72d4390c3f3b6ef0bd12e.tmp
<Current directory>\$dpx$.tmp\573d32e61e936f458bde1f89f8d08118.tmp
<Current directory>\$dpx$.tmp\109b3c081b917d48a779804e39aab366.tmp
<Current directory>\$dpx$.tmp\967fc936700e284796a912e09cfa20ca.tmp
<Current directory>\$dpx$.tmp\5bfb065a1bdcf84f8bb1f1d2f6ac79f6.tmp
<Current directory>\$dpx$.tmp\08f843b38f73ae4da4a98974cadd7f50.tmp
<Current directory>\$dpx$.tmp\f89a29097484eb42bb32c4dd36e5a578.tmp
<Current directory>\$dpx$.tmp\0a8e46cd6a43ca4988a45893393479bd.tmp
<Current directory>\$dpx$.tmp\5f56dd37bdc70242a70b63836a090946.tmp
<Current directory>\$dpx$.tmp\5768ceed156ce841ae5138215de10a65.tmp
<Current directory>\$dpx$.tmp\6ef340db7c16874280979e81f2956154.tmp
<Current directory>\$dpx$.tmp\34ff34b951a51f4caeebefb8ce7f2bf7.tmp
<Current directory>\$dpx$.tmp\f74332019138b147ac1c230abd2557bc.tmp
<Current directory>\$dpx$.tmp\168cbd3fe3355b46be505441edd49a92.tmp
<Current directory>\$dpx$.tmp\f807e122f75cdb43ae369c161fcbc91f.tmp
<Current directory>\$dpx$.tmp\8b1c859c7359994d99b487b04b797206.tmp
<Current directory>\$dpx$.tmp\8e53b698a14b6f4387d8930590452d83.tmp
<Current directory>\$dpx$.tmp\6ab8cd07b2214347a767bb730d63f317.tmp
<Current directory>\$dpx$.tmp\10d3edc855477745851ec8870ec9527d.tmp
<Current directory>\$dpx$.tmp\8035a385a4b99e499269d62922667328.tmp
<Current directory>\$dpx$.tmp\3c9624abd3122d4b8251fafdc1ee6ddc.tmp
<Current directory>\$dpx$.tmp\a5d2cb42fb24e64e81144d5a4fa2d3f2.tmp
<Current directory>\$dpx$.tmp\89d1f6c7e3ce064585ab17e3c8bd5eb6.tmp
<Current directory>\$dpx$.tmp\f5aa386a0d860940ad38746a8af75b4f.tmp
<Current directory>\$dpx$.tmp\b1aab39386b1724faee83ee2e98629ec.tmp
<Current directory>\$dpx$.tmp\a4928340855c124a86ccfe5b1c523eef.tmp
<Current directory>\$dpx$.tmp\d7be4c072761364e8416ca9eea613c88.tmp
<Current directory>\$dpx$.tmp\587ec3ff56697345bcc5c317e8e652f4.tmp
<Current directory>\$dpx$.tmp\42a8653435d4ec449f5e592d19f50cee.tmp
<Current directory>\$dpx$.tmp\9b6548cd9835ae48956cf3f7ac4b16a0.tmp
<Current directory>\$dpx$.tmp\bce57b2591f1114abae7df1a519c3c92.tmp
<Current directory>\$dpx$.tmp\95e3c2a78a98ba4bbdb66171da7bd4f5.tmp
<Current directory>\$dpx$.tmp\0aaaa5fd383d8443b4c12c6b731a1ead.tmp
<Current directory>\$dpx$.tmp\b5e7da72386e1c44ac0ee41b1ee11f03.tmp
<Current directory>\$dpx$.tmp\2e7913fc17217f43978e8e603ec28d7d.tmp
<Current directory>\$dpx$.tmp\62b0b99e91ab8f4fbba5cb92e46c9d0f.tmp
<Current directory>\$dpx$.tmp\f7f07e45256b414fae984b9f302c9589.tmp
<Current directory>\$dpx$.tmp\ec7a97c4fc1f9e4a9bdb55580aecf362.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\6ab8cd07b2214347a767bb730d63f317.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6293aab4b64d7b44bc467140d4d977d5.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f0b19f3c19835d47ad2f8058d8793941.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\40d2b2403196704db2b120532b436597.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c4d07e1519a98c42ab3cecdcc478e7a1.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8117f62fdae72d4390c3f3b6ef0bd12e.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\573d32e61e936f458bde1f89f8d08118.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\109b3c081b917d48a779804e39aab366.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f953f0ec2b147c47b65d0810f794e88a.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\152b38b26a8ee64fa5f78cef4b8e8b38.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\967fc936700e284796a912e09cfa20ca.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f89a29097484eb42bb32c4dd36e5a578.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0a8e46cd6a43ca4988a45893393479bd.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5f56dd37bdc70242a70b63836a090946.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5768ceed156ce841ae5138215de10a65.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6ef340db7c16874280979e81f2956154.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\34ff34b951a51f4caeebefb8ce7f2bf7.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\f74332019138b147ac1c230abd2557bc.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\5bfb065a1bdcf84f8bb1f1d2f6ac79f6.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\08f843b38f73ae4da4a98974cadd7f50.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\168cbd3fe3355b46be505441edd49a92.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8b1c859c7359994d99b487b04b797206.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\f7f07e45256b414fae984b9f302c9589.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8035a385a4b99e499269d62922667328.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3c9624abd3122d4b8251fafdc1ee6ddc.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a5d2cb42fb24e64e81144d5a4fa2d3f2.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\89d1f6c7e3ce064585ab17e3c8bd5eb6.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\f5aa386a0d860940ad38746a8af75b4f.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\b1aab39386b1724faee83ee2e98629ec.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a4928340855c124a86ccfe5b1c523eef.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d7be4c072761364e8416ca9eea613c88.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\10d3edc855477745851ec8870ec9527d.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\587ec3ff56697345bcc5c317e8e652f4.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9b6548cd9835ae48956cf3f7ac4b16a0.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bce57b2591f1114abae7df1a519c3c92.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\95e3c2a78a98ba4bbdb66171da7bd4f5.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0aaaa5fd383d8443b4c12c6b731a1ead.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b5e7da72386e1c44ac0ee41b1ee11f03.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\2e7913fc17217f43978e8e603ec28d7d.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\62b0b99e91ab8f4fbba5cb92e46c9d0f.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8e53b698a14b6f4387d8930590452d83.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\42a8653435d4ec449f5e592d19f50cee.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\f807e122f75cdb43ae369c161fcbc91f.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\ec7a97c4fc1f9e4a9bdb55580aecf362.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443
'lp##.haqo.net':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней