Trojan.DownLoader32.52330

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\34c9b9094cb8b64cbe855fc8a6deedd3.tmp
<Current directory>\$dpx$.tmp\b173323a64b0c34bafa9f2cfe9939f7c.tmp
<Current directory>\$dpx$.tmp\41d76a24d82e6448807d8015f9722bf6.tmp
<Current directory>\$dpx$.tmp\aa33a568945cde44ac7b4cb527e721e7.tmp
<Current directory>\$dpx$.tmp\4bd759c9e8d0dd41b86ad179c50a7639.tmp
<Current directory>\$dpx$.tmp\2d098861676459459d78635a0add885e.tmp
<Current directory>\$dpx$.tmp\acd2e3cb1014c542be3c743ab1aaf5f1.tmp
<Current directory>\$dpx$.tmp\bd0a014830c841498a874e509fbd2668.tmp
<Current directory>\$dpx$.tmp\ac78161983a0584c98d8a09e44726edb.tmp
<Current directory>\$dpx$.tmp\dfee42ccc1dd3c4294004c5d0f0e2c3e.tmp
<Current directory>\$dpx$.tmp\32af55ddee17ab4e9c2c1c4f88021d38.tmp
<Current directory>\$dpx$.tmp\abab005c1f5d224ea1abec8a8e0d117e.tmp
<Current directory>\$dpx$.tmp\353efc2928ea6344a7017f4e942a187c.tmp
<Current directory>\$dpx$.tmp\41603142a950c34dbcb9270859d68660.tmp
<Current directory>\$dpx$.tmp\7a145cb3eab1c94ca57be95cbe000842.tmp
<Current directory>\$dpx$.tmp\e499bc5fe35bb0448f0dbf3667c8360a.tmp
<Current directory>\$dpx$.tmp\1d4e285a30789e46b1ee6555805f2176.tmp
<Current directory>\$dpx$.tmp\7f93aba1708ca54fa95986098a2b1be8.tmp
<Current directory>\$dpx$.tmp\5e1fdebb4e2d8a429bc2a78beebe9d5b.tmp
<Current directory>\$dpx$.tmp\ee898c0aa916024a9996a393bf31ba27.tmp
<Current directory>\$dpx$.tmp\13be19e1812c4841b89acb329a3cb26f.tmp
<Current directory>\$dpx$.tmp\b765e06efa44bc45863c55ece8dcdada.tmp
<Current directory>\$dpx$.tmp\34cd2b6195d1354ab38fbca6ad588df2.tmp
<Current directory>\$dpx$.tmp\ba8bf9e6d3f6514bb00cb5b87f61f960.tmp
<Current directory>\$dpx$.tmp\3a4ba4778775624980d609847841cb5d.tmp
<Current directory>\$dpx$.tmp\ec9047f3558d3749b87d2c60f0f451cb.tmp
<Current directory>\$dpx$.tmp\989a276e6ebccb4c87a071e1b055500c.tmp
<Current directory>\$dpx$.tmp\15947388a00fbd499b0e1fd3ab03e4b0.tmp
<Current directory>\$dpx$.tmp\b12d4fee40928a45b580f456f80388c8.tmp
<Current directory>\$dpx$.tmp\66c46b2b48913f48a100e9a03edeee13.tmp
<Current directory>\$dpx$.tmp\387899f9ad995d49bd69c87b19d70da0.tmp
<Current directory>\$dpx$.tmp\cf4cbeaa8c0a644098fa0133f8186190.tmp
<Current directory>\$dpx$.tmp\bfc58d5960626d4b89b76657344f15f8.tmp
<Current directory>\$dpx$.tmp\3802b70a9d0a3a49b1fd67592fd88893.tmp
<Current directory>\$dpx$.tmp\8fdef13ab7b59549acd1485149b6b3e2.tmp
<Current directory>\$dpx$.tmp\84edf5eadb06854fb8ae756426310ab4.tmp
<Current directory>\$dpx$.tmp\c2c72bfddd24934bbe536b6225a96573.tmp
<Current directory>\$dpx$.tmp\dccc52207263294f8c52bf8b4b494e77.tmp
<Current directory>\$dpx$.tmp\4222140bc8d079429cf3f4f079986569.tmp
<Current directory>\$dpx$.tmp\ee33e084853b2f46b955cc9ad38568b5.tmp
<Current directory>\$dpx$.tmp\52a6a8d044409749855ea8ef7492c952.tmp
<Current directory>\$dpx$.tmp\fb819dbb935e524e8d77bba9d86a0448.tmp
<Current directory>\$dpx$.tmp\735c58f6175d5e4bb8a4c841b8cc282d.tmp
<Current directory>\$dpx$.tmp\96533bc882f9b94d9bfdbe37f0c3c1df.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\ba8bf9e6d3f6514bb00cb5b87f61f960.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\41d76a24d82e6448807d8015f9722bf6.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\aa33a568945cde44ac7b4cb527e721e7.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4bd759c9e8d0dd41b86ad179c50a7639.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2d098861676459459d78635a0add885e.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\acd2e3cb1014c542be3c743ab1aaf5f1.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bd0a014830c841498a874e509fbd2668.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ac78161983a0584c98d8a09e44726edb.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\34c9b9094cb8b64cbe855fc8a6deedd3.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b173323a64b0c34bafa9f2cfe9939f7c.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\dfee42ccc1dd3c4294004c5d0f0e2c3e.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\353efc2928ea6344a7017f4e942a187c.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\41603142a950c34dbcb9270859d68660.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7a145cb3eab1c94ca57be95cbe000842.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e499bc5fe35bb0448f0dbf3667c8360a.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1d4e285a30789e46b1ee6555805f2176.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7f93aba1708ca54fa95986098a2b1be8.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\5e1fdebb4e2d8a429bc2a78beebe9d5b.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\32af55ddee17ab4e9c2c1c4f88021d38.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\abab005c1f5d224ea1abec8a8e0d117e.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ee898c0aa916024a9996a393bf31ba27.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b765e06efa44bc45863c55ece8dcdada.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\735c58f6175d5e4bb8a4c841b8cc282d.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ec9047f3558d3749b87d2c60f0f451cb.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\989a276e6ebccb4c87a071e1b055500c.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\15947388a00fbd499b0e1fd3ab03e4b0.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b12d4fee40928a45b580f456f80388c8.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\66c46b2b48913f48a100e9a03edeee13.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\387899f9ad995d49bd69c87b19d70da0.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cf4cbeaa8c0a644098fa0133f8186190.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bfc58d5960626d4b89b76657344f15f8.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3a4ba4778775624980d609847841cb5d.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3802b70a9d0a3a49b1fd67592fd88893.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\84edf5eadb06854fb8ae756426310ab4.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c2c72bfddd24934bbe536b6225a96573.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\dccc52207263294f8c52bf8b4b494e77.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4222140bc8d079429cf3f4f079986569.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ee33e084853b2f46b955cc9ad38568b5.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\52a6a8d044409749855ea8ef7492c952.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fb819dbb935e524e8d77bba9d86a0448.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\34cd2b6195d1354ab38fbca6ad588df2.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8fdef13ab7b59549acd1485149b6b3e2.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\13be19e1812c4841b89acb329a3cb26f.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\96533bc882f9b94d9bfdbe37f0c3c1df.tmp to <Current directory>\vcruntime140.dll

Network activity

Connects to

'lp##.beahh.com':443

TCP

'lp##.abbny.com':443
'lp##.haqo.net':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней