Trojan.DownLoader32.65217

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\2bae100a918e69439439fe4b23ca6543.tmp
<Current directory>\$dpx$.tmp\dea8ed6a67e8da4d89f5defd847f87a6.tmp
<Current directory>\$dpx$.tmp\729d8ff5cd30d84ca4360590be51cb4e.tmp
<Current directory>\$dpx$.tmp\40b969ad9c6f584cbea741241883d25b.tmp
<Current directory>\$dpx$.tmp\b4b1fabb806c1c468f7a278f3a0df1d7.tmp
<Current directory>\$dpx$.tmp\6b78079a2c618449ade2976c3f01ba82.tmp
<Current directory>\$dpx$.tmp\d9d2c70ad29a1b40b889cfc600333c13.tmp
<Current directory>\$dpx$.tmp\f65ae48138a0274ca397423cdf54a5d4.tmp
<Current directory>\$dpx$.tmp\67d65e607156d94aaaae63a2ddb70f94.tmp
<Current directory>\$dpx$.tmp\9aab23110364874e8e73751d24fb686d.tmp
<Current directory>\$dpx$.tmp\d39218b3d3a06047befa51a5db230ee1.tmp
<Current directory>\$dpx$.tmp\202cdbb5dd07ab43b994b8b6b4838aef.tmp
<Current directory>\$dpx$.tmp\6e9017708891b14f9a3c03dfe11a04e3.tmp
<Current directory>\$dpx$.tmp\38bbcb98aa6c6e4d9eea1f6eca5303e6.tmp
<Current directory>\$dpx$.tmp\743465e25b14604884d0e334925e33f4.tmp
<Current directory>\$dpx$.tmp\3be32632e5cd0040945080bf7c0160aa.tmp
<Current directory>\$dpx$.tmp\9e7462f7c9fc3c49b6751b788d3a173f.tmp
<Current directory>\$dpx$.tmp\ac7a9e49ab4f134b935346e743b4dc0e.tmp
<Current directory>\$dpx$.tmp\357668f263c2b7488b15755af3531ef3.tmp
<Current directory>\$dpx$.tmp\863bfdd759994c45917f8f9ce618535e.tmp
<Current directory>\$dpx$.tmp\5ed0326b1a3ffe4ba243d33a4eb3e481.tmp
<Current directory>\$dpx$.tmp\57ff26039863ee4b8cfffa6fbbcb789a.tmp
<Current directory>\$dpx$.tmp\f20d7f2f7d135f428537c159cc962f32.tmp
<Current directory>\$dpx$.tmp\fce11f7e9bf8f745b8c3d6fb5a625c00.tmp
<Current directory>\$dpx$.tmp\2c1287d5bb08fb4bbfd9b2f5f96fa85b.tmp
<Current directory>\$dpx$.tmp\7749ec1fac1a1d4f9ca11cf7dc42c8b2.tmp
<Current directory>\$dpx$.tmp\501a00745c393f4192207ad4531e5f5b.tmp
<Current directory>\$dpx$.tmp\1d2e5803058c39409185125a63a8023a.tmp
<Current directory>\$dpx$.tmp\11b43666d6b5ff4f91cb9e2c23c450aa.tmp
<Current directory>\$dpx$.tmp\2fb4f540aacd824a92caf7f013cd33d6.tmp
<Current directory>\$dpx$.tmp\92abbd1a559ab849adeecb28f565ce4d.tmp
<Current directory>\$dpx$.tmp\7d7391f397bb1f49a9aaf78843bfa38d.tmp
<Current directory>\$dpx$.tmp\03190567ebd84f47957b90715a70bb91.tmp
<Current directory>\$dpx$.tmp\78e51e87e18e6c45b9e9992e5dd775b8.tmp
<Current directory>\$dpx$.tmp\b241c2a079b01b479f85b6a35d765a35.tmp
<Current directory>\$dpx$.tmp\50ec81b85af9df44aec9d640a92f49bd.tmp
<Current directory>\$dpx$.tmp\9fe972e9e4b8a143bb58ed5ddc23ece8.tmp
<Current directory>\$dpx$.tmp\8acd2d4b1cd2004bb942f711d014f221.tmp
<Current directory>\$dpx$.tmp\621e16f621a85c4b9a8ccae035430be4.tmp
<Current directory>\$dpx$.tmp\7916ed00d7494b4abefe3b48d608d0b0.tmp
<Current directory>\$dpx$.tmp\1069e0bfe8463340a62d24488427cc2c.tmp
<Current directory>\$dpx$.tmp\f2c0cf1eff76ba42962c16da26b5de57.tmp
<Current directory>\$dpx$.tmp\ef89dda3d31aad4ab0de747f4e4149ea.tmp
<Current directory>\$dpx$.tmp\da800a91b0cf204c977834a4f80fb46f.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\fce11f7e9bf8f745b8c3d6fb5a625c00.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\729d8ff5cd30d84ca4360590be51cb4e.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\40b969ad9c6f584cbea741241883d25b.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b4b1fabb806c1c468f7a278f3a0df1d7.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6b78079a2c618449ade2976c3f01ba82.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d9d2c70ad29a1b40b889cfc600333c13.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f65ae48138a0274ca397423cdf54a5d4.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\67d65e607156d94aaaae63a2ddb70f94.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2bae100a918e69439439fe4b23ca6543.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\dea8ed6a67e8da4d89f5defd847f87a6.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9aab23110364874e8e73751d24fb686d.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6e9017708891b14f9a3c03dfe11a04e3.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\38bbcb98aa6c6e4d9eea1f6eca5303e6.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\743465e25b14604884d0e334925e33f4.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3be32632e5cd0040945080bf7c0160aa.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9e7462f7c9fc3c49b6751b788d3a173f.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ac7a9e49ab4f134b935346e743b4dc0e.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\357668f263c2b7488b15755af3531ef3.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\d39218b3d3a06047befa51a5db230ee1.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\202cdbb5dd07ab43b994b8b6b4838aef.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\863bfdd759994c45917f8f9ce618535e.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\57ff26039863ee4b8cfffa6fbbcb789a.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\ef89dda3d31aad4ab0de747f4e4149ea.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7749ec1fac1a1d4f9ca11cf7dc42c8b2.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\501a00745c393f4192207ad4531e5f5b.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1d2e5803058c39409185125a63a8023a.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\11b43666d6b5ff4f91cb9e2c23c450aa.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\2fb4f540aacd824a92caf7f013cd33d6.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\92abbd1a559ab849adeecb28f565ce4d.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7d7391f397bb1f49a9aaf78843bfa38d.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\03190567ebd84f47957b90715a70bb91.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2c1287d5bb08fb4bbfd9b2f5f96fa85b.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\78e51e87e18e6c45b9e9992e5dd775b8.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\50ec81b85af9df44aec9d640a92f49bd.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9fe972e9e4b8a143bb58ed5ddc23ece8.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8acd2d4b1cd2004bb942f711d014f221.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\621e16f621a85c4b9a8ccae035430be4.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7916ed00d7494b4abefe3b48d608d0b0.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\1069e0bfe8463340a62d24488427cc2c.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f2c0cf1eff76ba42962c16da26b5de57.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f20d7f2f7d135f428537c159cc962f32.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b241c2a079b01b479f85b6a35d765a35.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\5ed0326b1a3ffe4ba243d33a4eb3e481.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\da800a91b0cf204c977834a4f80fb46f.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443
'lp##.haqo.net':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней