Trojan.DownLoader32.58170

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\c9604daccdb9704fa9dffd0d8c0b2277.tmp
<Current directory>\$dpx$.tmp\90f6a19a5424df408a302f8656bb519a.tmp
<Current directory>\$dpx$.tmp\e3f24a90d1fee342abb952d829de7f6d.tmp
<Current directory>\$dpx$.tmp\ddd222eb0a1b6140929e63d3d2edddf4.tmp
<Current directory>\$dpx$.tmp\54f998cb75004346b44bead62b5faee8.tmp
<Current directory>\$dpx$.tmp\e14409b36ca26749a83547d38690ab98.tmp
<Current directory>\$dpx$.tmp\404f7f5725039b41a5ca752be428173e.tmp
<Current directory>\$dpx$.tmp\dd9b4a6c99841b45a665395b4dc81767.tmp
<Current directory>\$dpx$.tmp\6b8304ac55ca3940b7796298434ca034.tmp
<Current directory>\$dpx$.tmp\3efaabeaeda7914ea840b812b7d18533.tmp
<Current directory>\$dpx$.tmp\100412666b209c4e9cfd938261c1f656.tmp
<Current directory>\$dpx$.tmp\2059e66bb32c9e4e8a9bc53caff8500b.tmp
<Current directory>\$dpx$.tmp\a5e52314b0b86b43a65cad98c8a2e536.tmp
<Current directory>\$dpx$.tmp\ab324c27a7e4734eaaa7d51240fb1742.tmp
<Current directory>\$dpx$.tmp\9dcc67c4d9915b419b0ca2c4f0342764.tmp
<Current directory>\$dpx$.tmp\c75178321c87af488c312fb6813e79f4.tmp
<Current directory>\$dpx$.tmp\97cd8868e6e31f4dac36022ad84d9a94.tmp
<Current directory>\$dpx$.tmp\364f772c0666354f9c60fdc2659a3ee0.tmp
<Current directory>\$dpx$.tmp\5bfd26ea0972b7429f5a5bf103ff34b5.tmp
<Current directory>\$dpx$.tmp\43c122d1dc1c014aa139d95650ae88af.tmp
<Current directory>\$dpx$.tmp\ef4e754cc02f2148b7ab419e4a81e960.tmp
<Current directory>\$dpx$.tmp\2c37b3ca3c9c054f9c272fe7413bd6eb.tmp
<Current directory>\$dpx$.tmp\0991ff4dc047a44da1917dcc3c51eed8.tmp
<Current directory>\$dpx$.tmp\aea8cb6da55b1d42b1e9d34eb33b46bf.tmp
<Current directory>\$dpx$.tmp\f43c88d1fac1b848be090e77df82def2.tmp
<Current directory>\$dpx$.tmp\9df26b31d663184388681d4ef0a01691.tmp
<Current directory>\$dpx$.tmp\0dbb9de9ac4a0443917dc84ffd62d536.tmp
<Current directory>\$dpx$.tmp\5d680776289ac04cbb0f6b3922cbdb24.tmp
<Current directory>\$dpx$.tmp\5b4bd1ff6813e74987da2e798990666e.tmp
<Current directory>\$dpx$.tmp\149987fd9ec9d047ab360cb02a3e6356.tmp
<Current directory>\$dpx$.tmp\13c17e2954ff7c4ea11655bfc0a2cc47.tmp
<Current directory>\$dpx$.tmp\4ca1082cdceea2409091ed58d9d58266.tmp
<Current directory>\$dpx$.tmp\76f502b6410fcc4381effd0d21ffc670.tmp
<Current directory>\$dpx$.tmp\295ab8beda9b9a46b4020090be0f61ff.tmp
<Current directory>\$dpx$.tmp\859a8d7c3c72f640af94066b8618b363.tmp
<Current directory>\$dpx$.tmp\ee756c035a6a4343aa7c4efbf740c3bf.tmp
<Current directory>\$dpx$.tmp\7cc8a98e358c7a4dbf90bb08fae8b773.tmp
<Current directory>\$dpx$.tmp\933cbc9dea39cc46a74a95261fcfb626.tmp
<Current directory>\$dpx$.tmp\b7ed375c2a02864ebc3f28a93a4abd5f.tmp
<Current directory>\$dpx$.tmp\a8dce032598d994eb7cfe0f5969c29c2.tmp
<Current directory>\$dpx$.tmp\6f6f9f0ff885ce4ba72a2f149219510a.tmp
<Current directory>\$dpx$.tmp\fb1feda4d4926c48a2ed4bcc523bf65f.tmp
<Current directory>\$dpx$.tmp\5eb88aff00f8ea42ad46fce9c00204ad.tmp
<Current directory>\$dpx$.tmp\2a6a91108b51fd489cee8dd4377e4805.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\aea8cb6da55b1d42b1e9d34eb33b46bf.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e3f24a90d1fee342abb952d829de7f6d.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ddd222eb0a1b6140929e63d3d2edddf4.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\54f998cb75004346b44bead62b5faee8.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e14409b36ca26749a83547d38690ab98.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\404f7f5725039b41a5ca752be428173e.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\dd9b4a6c99841b45a665395b4dc81767.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6b8304ac55ca3940b7796298434ca034.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c9604daccdb9704fa9dffd0d8c0b2277.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\90f6a19a5424df408a302f8656bb519a.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3efaabeaeda7914ea840b812b7d18533.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a5e52314b0b86b43a65cad98c8a2e536.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ab324c27a7e4734eaaa7d51240fb1742.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9dcc67c4d9915b419b0ca2c4f0342764.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c75178321c87af488c312fb6813e79f4.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\97cd8868e6e31f4dac36022ad84d9a94.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\364f772c0666354f9c60fdc2659a3ee0.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\5bfd26ea0972b7429f5a5bf103ff34b5.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\100412666b209c4e9cfd938261c1f656.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2059e66bb32c9e4e8a9bc53caff8500b.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\43c122d1dc1c014aa139d95650ae88af.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2c37b3ca3c9c054f9c272fe7413bd6eb.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\5eb88aff00f8ea42ad46fce9c00204ad.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9df26b31d663184388681d4ef0a01691.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0dbb9de9ac4a0443917dc84ffd62d536.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5d680776289ac04cbb0f6b3922cbdb24.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5b4bd1ff6813e74987da2e798990666e.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\149987fd9ec9d047ab360cb02a3e6356.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\13c17e2954ff7c4ea11655bfc0a2cc47.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4ca1082cdceea2409091ed58d9d58266.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\76f502b6410fcc4381effd0d21ffc670.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f43c88d1fac1b848be090e77df82def2.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\295ab8beda9b9a46b4020090be0f61ff.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ee756c035a6a4343aa7c4efbf740c3bf.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7cc8a98e358c7a4dbf90bb08fae8b773.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\933cbc9dea39cc46a74a95261fcfb626.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b7ed375c2a02864ebc3f28a93a4abd5f.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a8dce032598d994eb7cfe0f5969c29c2.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\6f6f9f0ff885ce4ba72a2f149219510a.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fb1feda4d4926c48a2ed4bcc523bf65f.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0991ff4dc047a44da1917dcc3c51eed8.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\859a8d7c3c72f640af94066b8618b363.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\ef4e754cc02f2148b7ab419e4a81e960.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\2a6a91108b51fd489cee8dd4377e4805.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443
'lp##.haqo.net':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней