Trojan.DownLoader32.65213

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\babec59c4a5bec46b3bd4646d23d01ef.tmp
<Current directory>\$dpx$.tmp\a958b51272834b43aa2f32ebb1878dc8.tmp
<Current directory>\$dpx$.tmp\b90b3539ff04db44a003ec966e7c6e13.tmp
<Current directory>\$dpx$.tmp\d177f6c2399b1d4f91115456cec3213f.tmp
<Current directory>\$dpx$.tmp\8ef7387780f0ba47ad47f27b5e5c6171.tmp
<Current directory>\$dpx$.tmp\2757f97042970a4fb2d291bcd673bba9.tmp
<Current directory>\$dpx$.tmp\378260e82c9edb4aaa8e1f6fb9dc3d09.tmp
<Current directory>\$dpx$.tmp\eccada4a4a52c34b9e8ac8f00fcfdc73.tmp
<Current directory>\$dpx$.tmp\f10cc3e0694b03469f6d0b7b7fed5754.tmp
<Current directory>\$dpx$.tmp\5c8b541f15b0c54bade1bc0726e164c5.tmp
<Current directory>\$dpx$.tmp\fd30e4be8a707947bc4f3fab941a1599.tmp
<Current directory>\$dpx$.tmp\51db814af6386748b19476bd132da4e6.tmp
<Current directory>\$dpx$.tmp\57da43be7ea0bd45bdee43327ad40dee.tmp
<Current directory>\$dpx$.tmp\aaec23f1a801b7488462f723bc7f0cc1.tmp
<Current directory>\$dpx$.tmp\1aa2108345e14d489ef8aaf742d077f2.tmp
<Current directory>\$dpx$.tmp\647c85f09604b445b6006c3f3097ca3b.tmp
<Current directory>\$dpx$.tmp\d72850a41047c247a73002198db4f5bd.tmp
<Current directory>\$dpx$.tmp\17145b511f732b48bbf5ba3f259ce684.tmp
<Current directory>\$dpx$.tmp\c9b6f1328b7e544495b8fffd33ccb288.tmp
<Current directory>\$dpx$.tmp\21b0f070bab3f64286b623424d3199a6.tmp
<Current directory>\$dpx$.tmp\4317f9ebbecd50418618ade83bd98ae1.tmp
<Current directory>\$dpx$.tmp\a015e348077e9e4c8923d302bea28a53.tmp
<Current directory>\$dpx$.tmp\c55e503d6d4c8f4b970d388f0558072e.tmp
<Current directory>\$dpx$.tmp\ff7abfd4b06e27499cba6b86845cb03b.tmp
<Current directory>\$dpx$.tmp\7e86d355cb706148a01602518ab08fe3.tmp
<Current directory>\$dpx$.tmp\30d6011e96f70343861e1fe557f0e172.tmp
<Current directory>\$dpx$.tmp\bc6f46b8954ac64a873a60243583070d.tmp
<Current directory>\$dpx$.tmp\5ddf45a00b0661469e382e064fd7ffad.tmp
<Current directory>\$dpx$.tmp\50f83b37111d6f44a0fdb197a6f72b63.tmp
<Current directory>\$dpx$.tmp\7e30d7b9fe2b414eb46a74a31141e704.tmp
<Current directory>\$dpx$.tmp\9fec61b82f964e4e9aca14a9615d7e6b.tmp
<Current directory>\$dpx$.tmp\d516f512861e6445b24ef880d42934e9.tmp
<Current directory>\$dpx$.tmp\fe30c3568b2e7e49934176aae1069b7e.tmp
<Current directory>\$dpx$.tmp\f55dafbcd0df1548a429099c70b4d954.tmp
<Current directory>\$dpx$.tmp\f3b7fa1778e6d142b6f9fbe73d03d091.tmp
<Current directory>\$dpx$.tmp\6f174b3f683b8a4cb0656dc5d64c126a.tmp
<Current directory>\$dpx$.tmp\0927aef747fca247961e44bf37d56299.tmp
<Current directory>\$dpx$.tmp\a1ac5d4f24b1054a955028beae4ffb7d.tmp
<Current directory>\$dpx$.tmp\94b1a460b9650c4fba1c010b9471819b.tmp
<Current directory>\$dpx$.tmp\ba5275ea12dd61429240028beeee09cd.tmp
<Current directory>\$dpx$.tmp\31f3b515a2c31149a2afab3500720d16.tmp
<Current directory>\$dpx$.tmp\613162ec6fbc714897854e0d51adb5b0.tmp
<Current directory>\$dpx$.tmp\f5efdf576d6a9243a6eee764ad25b637.tmp
<Current directory>\$dpx$.tmp\7f1b74a9a8c9104a9c61a491bde63110.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\ff7abfd4b06e27499cba6b86845cb03b.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b90b3539ff04db44a003ec966e7c6e13.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d177f6c2399b1d4f91115456cec3213f.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8ef7387780f0ba47ad47f27b5e5c6171.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2757f97042970a4fb2d291bcd673bba9.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\378260e82c9edb4aaa8e1f6fb9dc3d09.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\eccada4a4a52c34b9e8ac8f00fcfdc73.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f10cc3e0694b03469f6d0b7b7fed5754.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\babec59c4a5bec46b3bd4646d23d01ef.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a958b51272834b43aa2f32ebb1878dc8.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5c8b541f15b0c54bade1bc0726e164c5.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\57da43be7ea0bd45bdee43327ad40dee.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\aaec23f1a801b7488462f723bc7f0cc1.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1aa2108345e14d489ef8aaf742d077f2.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\647c85f09604b445b6006c3f3097ca3b.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d72850a41047c247a73002198db4f5bd.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\17145b511f732b48bbf5ba3f259ce684.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\c9b6f1328b7e544495b8fffd33ccb288.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\fd30e4be8a707947bc4f3fab941a1599.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\51db814af6386748b19476bd132da4e6.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\21b0f070bab3f64286b623424d3199a6.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a015e348077e9e4c8923d302bea28a53.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\f5efdf576d6a9243a6eee764ad25b637.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\30d6011e96f70343861e1fe557f0e172.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bc6f46b8954ac64a873a60243583070d.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5ddf45a00b0661469e382e064fd7ffad.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\50f83b37111d6f44a0fdb197a6f72b63.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\7e30d7b9fe2b414eb46a74a31141e704.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\9fec61b82f964e4e9aca14a9615d7e6b.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d516f512861e6445b24ef880d42934e9.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fe30c3568b2e7e49934176aae1069b7e.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7e86d355cb706148a01602518ab08fe3.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f55dafbcd0df1548a429099c70b4d954.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6f174b3f683b8a4cb0656dc5d64c126a.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0927aef747fca247961e44bf37d56299.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a1ac5d4f24b1054a955028beae4ffb7d.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\94b1a460b9650c4fba1c010b9471819b.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ba5275ea12dd61429240028beeee09cd.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\31f3b515a2c31149a2afab3500720d16.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\613162ec6fbc714897854e0d51adb5b0.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c55e503d6d4c8f4b970d388f0558072e.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f3b7fa1778e6d142b6f9fbe73d03d091.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\4317f9ebbecd50418618ade83bd98ae1.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\7f1b74a9a8c9104a9c61a491bde63110.tmp to <Current directory>\vcruntime140.dll

Network activity

Connects to

'lp##.beahh.com':443

TCP

'lp##.abbny.com':443
'lp##.haqo.net':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней