Trojan.DownLoader32.52448

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\abe5bcbc39915e4ba16f4e8b2d5dbaa3.tmp
<Current directory>\$dpx$.tmp\f3229e27df22a7498cfef7b1488b3bb6.tmp
<Current directory>\$dpx$.tmp\1c89af98280d464593f160daa8b5382b.tmp
<Current directory>\$dpx$.tmp\659e08ee2dea3244898bdf17761e1fbf.tmp
<Current directory>\$dpx$.tmp\ecd894d2b0e99147809a64ba7bdf84dd.tmp
<Current directory>\$dpx$.tmp\0e2a4bbf45caf840831ead45c3ffe49c.tmp
<Current directory>\$dpx$.tmp\a59fb87dd280ee41be3a95428b079c24.tmp
<Current directory>\$dpx$.tmp\c91ec9d6ebebec4fbc626300beb8c28d.tmp
<Current directory>\$dpx$.tmp\ecf536255001754595651ba6a0254df2.tmp
<Current directory>\$dpx$.tmp\fc1c97d99fca0d4f82e4b38729def1a7.tmp
<Current directory>\$dpx$.tmp\fcc90e23e72ada478ffd6447d8a66e9d.tmp
<Current directory>\$dpx$.tmp\e300996c23e5a04ca0333a8714bb834b.tmp
<Current directory>\$dpx$.tmp\ebdd609ad8cb0f41bc76db733f94c0c9.tmp
<Current directory>\$dpx$.tmp\b7d6cbff30fbda468a4fdf5cd97ffe9c.tmp
<Current directory>\$dpx$.tmp\818a45869cdcad4f9201b73b0db9d5de.tmp
<Current directory>\$dpx$.tmp\89843b82d0f08c4ba532a80d48a2a0b4.tmp
<Current directory>\$dpx$.tmp\9d7412a207175a40a0eeb034ed64220b.tmp
<Current directory>\$dpx$.tmp\340de1c75b98fb489796f9ab46c82102.tmp
<Current directory>\$dpx$.tmp\7c9388205d3f914e8573dbde0aeee62b.tmp
<Current directory>\$dpx$.tmp\d3b1ccca5abfdd4d92fabb02d05308ac.tmp
<Current directory>\$dpx$.tmp\5230b729a6f2e2459b808536ae895f3e.tmp
<Current directory>\$dpx$.tmp\1722df782497da4082bf7ae2f2a33c2b.tmp
<Current directory>\$dpx$.tmp\4b063d6762068147b228cf9d37fff369.tmp
<Current directory>\$dpx$.tmp\624d32c668920d4a933cdfaa80d815c5.tmp
<Current directory>\$dpx$.tmp\3f3ffc8b75edb649b125ea06b9c14e67.tmp
<Current directory>\$dpx$.tmp\e07e90e31fd6ae41b4a2fde0ddbc8242.tmp
<Current directory>\$dpx$.tmp\d512f92234eb3343bfe39c9362c54240.tmp
<Current directory>\$dpx$.tmp\2f87142d6d149e45a2cb5b5ae9f72f18.tmp
<Current directory>\$dpx$.tmp\2eed497c18d426428b7a745b3bd02ddf.tmp
<Current directory>\$dpx$.tmp\20ef576aae9f974198ef8247d382e4e5.tmp
<Current directory>\$dpx$.tmp\27d4f1aab3a175449a71d12db4fb819e.tmp
<Current directory>\$dpx$.tmp\1a2a7c17fabe0d4abfc1304b9a491815.tmp
<Current directory>\$dpx$.tmp\1553635e493b7a45b977058fac1bbcf2.tmp
<Current directory>\$dpx$.tmp\e7c70f92c364704db489c38489906fa2.tmp
<Current directory>\$dpx$.tmp\3468708b293ade48815ca0bd4126230b.tmp
<Current directory>\$dpx$.tmp\254decdabc79e84383e536b4b5cb10b8.tmp
<Current directory>\$dpx$.tmp\4d285bee77f0a54880c0ace977e67fac.tmp
<Current directory>\$dpx$.tmp\6b7d8e332b7a5946ae8a1fd66b8d7463.tmp
<Current directory>\$dpx$.tmp\3729105e5fa74e4f9a8551579f1f7605.tmp
<Current directory>\$dpx$.tmp\d9b7e7e2f02da74eb4013769d094c0a9.tmp
<Current directory>\$dpx$.tmp\8d68afdae9947747860b2405ee2f782b.tmp
<Current directory>\$dpx$.tmp\e681d86bcb5333428b2b3876517cf836.tmp
<Current directory>\$dpx$.tmp\6a590eef29f1f242b8659ec7ab12fd25.tmp
<Current directory>\$dpx$.tmp\fc606d6b1a6efb44951b40a0b89b05cb.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\624d32c668920d4a933cdfaa80d815c5.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1c89af98280d464593f160daa8b5382b.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\659e08ee2dea3244898bdf17761e1fbf.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ecd894d2b0e99147809a64ba7bdf84dd.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0e2a4bbf45caf840831ead45c3ffe49c.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a59fb87dd280ee41be3a95428b079c24.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c91ec9d6ebebec4fbc626300beb8c28d.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ecf536255001754595651ba6a0254df2.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\abe5bcbc39915e4ba16f4e8b2d5dbaa3.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f3229e27df22a7498cfef7b1488b3bb6.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fc1c97d99fca0d4f82e4b38729def1a7.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ebdd609ad8cb0f41bc76db733f94c0c9.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b7d6cbff30fbda468a4fdf5cd97ffe9c.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\818a45869cdcad4f9201b73b0db9d5de.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\89843b82d0f08c4ba532a80d48a2a0b4.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9d7412a207175a40a0eeb034ed64220b.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\340de1c75b98fb489796f9ab46c82102.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\7c9388205d3f914e8573dbde0aeee62b.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\fcc90e23e72ada478ffd6447d8a66e9d.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e300996c23e5a04ca0333a8714bb834b.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d3b1ccca5abfdd4d92fabb02d05308ac.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1722df782497da4082bf7ae2f2a33c2b.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\6a590eef29f1f242b8659ec7ab12fd25.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e07e90e31fd6ae41b4a2fde0ddbc8242.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d512f92234eb3343bfe39c9362c54240.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2f87142d6d149e45a2cb5b5ae9f72f18.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2eed497c18d426428b7a745b3bd02ddf.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\20ef576aae9f974198ef8247d382e4e5.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\27d4f1aab3a175449a71d12db4fb819e.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1a2a7c17fabe0d4abfc1304b9a491815.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1553635e493b7a45b977058fac1bbcf2.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3f3ffc8b75edb649b125ea06b9c14e67.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e7c70f92c364704db489c38489906fa2.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\254decdabc79e84383e536b4b5cb10b8.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4d285bee77f0a54880c0ace977e67fac.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6b7d8e332b7a5946ae8a1fd66b8d7463.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3729105e5fa74e4f9a8551579f1f7605.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d9b7e7e2f02da74eb4013769d094c0a9.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\8d68afdae9947747860b2405ee2f782b.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e681d86bcb5333428b2b3876517cf836.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4b063d6762068147b228cf9d37fff369.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3468708b293ade48815ca0bd4126230b.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\5230b729a6f2e2459b808536ae895f3e.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\fc606d6b1a6efb44951b40a0b89b05cb.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443
'lp##.haqo.net':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней