Trojan.DownLoader32.57261

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\feadf30f460f00489c0ea7994db3e52b.tmp
<Current directory>\$dpx$.tmp\ac4065c3a67a56478c5a6694ce887a9f.tmp
<Current directory>\$dpx$.tmp\cf916080335b61468b1609a7f28cb27e.tmp
<Current directory>\$dpx$.tmp\650d7c48933494469a4762a4da8eb8c0.tmp
<Current directory>\$dpx$.tmp\40a9d471d898f1498c2b3f2dceacef31.tmp
<Current directory>\$dpx$.tmp\3681d7389acff24896accf50e3988598.tmp
<Current directory>\$dpx$.tmp\623faf3f5791854cbc9d8a1da691c5d6.tmp
<Current directory>\$dpx$.tmp\1a31efb46b47e64b8f20c95863c44b27.tmp
<Current directory>\$dpx$.tmp\c7d2b452a3616b44ab0b1861234e4744.tmp
<Current directory>\$dpx$.tmp\dc753d66c01e4240b3f83fa1f67914c4.tmp
<Current directory>\$dpx$.tmp\9122569112b0b54486c433db950202ff.tmp
<Current directory>\$dpx$.tmp\afaeea57440c2b418c84d1ffb22c180f.tmp
<Current directory>\$dpx$.tmp\b3959299e8db424cb7c3652080fd4581.tmp
<Current directory>\$dpx$.tmp\22a3911eb3cf1f4fa522b846f80c67df.tmp
<Current directory>\$dpx$.tmp\df9ac90f35425a469c07c05a00cdc0e5.tmp
<Current directory>\$dpx$.tmp\7029ed67f9a15245b38c65cae61c5dcf.tmp
<Current directory>\$dpx$.tmp\25d428ea83c62449b8c567131bd5a1d2.tmp
<Current directory>\$dpx$.tmp\ef91b5875cb51244a476bef427390aca.tmp
<Current directory>\$dpx$.tmp\127d6459470e6c4b92546d9add6dc6c3.tmp
<Current directory>\$dpx$.tmp\3022afa733749e4499f6feb91abecb45.tmp
<Current directory>\$dpx$.tmp\18e067d1d570424d8c4de740b684c52b.tmp
<Current directory>\$dpx$.tmp\022bc0ab67f6d442aa667ebe8ae4aa43.tmp
<Current directory>\$dpx$.tmp\5db703821b2fbb42865453eaeab859d7.tmp
<Current directory>\$dpx$.tmp\5ebda95bff606a4a808fc0ed80dbb865.tmp
<Current directory>\$dpx$.tmp\dcbc037b551a234ead3f683833828d6f.tmp
<Current directory>\$dpx$.tmp\c556d6289a8e5e47939fee877b166bdc.tmp
<Current directory>\$dpx$.tmp\5f5504fbaaeef8428091ea48c249de52.tmp
<Current directory>\$dpx$.tmp\df8cec737b20364f9ebbae493f13bad6.tmp
<Current directory>\$dpx$.tmp\820e7576ddcd2742b65543d1a8d42a42.tmp
<Current directory>\$dpx$.tmp\d0c14b844c4c1e42a793c96a58466c55.tmp
<Current directory>\$dpx$.tmp\bbed0ca2b4e3654fbf2854d6f71316fc.tmp
<Current directory>\$dpx$.tmp\75bd237ad8b5a444ba8ac111d05f9c81.tmp
<Current directory>\$dpx$.tmp\e73bce3a82bb5f4c8a821fc1abc58378.tmp
<Current directory>\$dpx$.tmp\e3913d96e111ae4f907d18dbf71577aa.tmp
<Current directory>\$dpx$.tmp\c0798f3aa8b4fb4f9a20160138d08611.tmp
<Current directory>\$dpx$.tmp\c6fab9a785a9074793ea81b80d114f4b.tmp
<Current directory>\$dpx$.tmp\aa1cc12e12855a4186db8297311fafc5.tmp
<Current directory>\$dpx$.tmp\d1f6285874f60b4fa8f0b3a4319dce41.tmp
<Current directory>\$dpx$.tmp\e688f8be7d0de84a9666587522ec00d7.tmp
<Current directory>\$dpx$.tmp\0ed1b3b3a71e4d41b244118ee5a150fc.tmp
<Current directory>\$dpx$.tmp\b74f062342c2424db90898af74c6518e.tmp
<Current directory>\$dpx$.tmp\82b14da4e08bfa4f8e3ec290558aed98.tmp
<Current directory>\$dpx$.tmp\387907803229594eb4d8af96b3fd2d3a.tmp
<Current directory>\$dpx$.tmp\ab2e7da00ea563489d1a0c5b69149805.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\5ebda95bff606a4a808fc0ed80dbb865.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cf916080335b61468b1609a7f28cb27e.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\650d7c48933494469a4762a4da8eb8c0.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\40a9d471d898f1498c2b3f2dceacef31.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3681d7389acff24896accf50e3988598.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\623faf3f5791854cbc9d8a1da691c5d6.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1a31efb46b47e64b8f20c95863c44b27.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c7d2b452a3616b44ab0b1861234e4744.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\feadf30f460f00489c0ea7994db3e52b.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ac4065c3a67a56478c5a6694ce887a9f.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\dc753d66c01e4240b3f83fa1f67914c4.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b3959299e8db424cb7c3652080fd4581.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\22a3911eb3cf1f4fa522b846f80c67df.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\df9ac90f35425a469c07c05a00cdc0e5.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7029ed67f9a15245b38c65cae61c5dcf.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\25d428ea83c62449b8c567131bd5a1d2.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ef91b5875cb51244a476bef427390aca.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\127d6459470e6c4b92546d9add6dc6c3.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\9122569112b0b54486c433db950202ff.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\afaeea57440c2b418c84d1ffb22c180f.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3022afa733749e4499f6feb91abecb45.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\022bc0ab67f6d442aa667ebe8ae4aa43.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\387907803229594eb4d8af96b3fd2d3a.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c556d6289a8e5e47939fee877b166bdc.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5f5504fbaaeef8428091ea48c249de52.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\df8cec737b20364f9ebbae493f13bad6.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\820e7576ddcd2742b65543d1a8d42a42.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\d0c14b844c4c1e42a793c96a58466c55.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\bbed0ca2b4e3654fbf2854d6f71316fc.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\75bd237ad8b5a444ba8ac111d05f9c81.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e73bce3a82bb5f4c8a821fc1abc58378.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\dcbc037b551a234ead3f683833828d6f.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e3913d96e111ae4f907d18dbf71577aa.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c6fab9a785a9074793ea81b80d114f4b.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\aa1cc12e12855a4186db8297311fafc5.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d1f6285874f60b4fa8f0b3a4319dce41.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e688f8be7d0de84a9666587522ec00d7.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0ed1b3b3a71e4d41b244118ee5a150fc.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\b74f062342c2424db90898af74c6518e.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\82b14da4e08bfa4f8e3ec290558aed98.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5db703821b2fbb42865453eaeab859d7.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c0798f3aa8b4fb4f9a20160138d08611.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\18e067d1d570424d8c4de740b684c52b.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\ab2e7da00ea563489d1a0c5b69149805.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443
'lp##.haqo.net':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней