Trojan.DownLoader32.43777

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\f4acf6b78717b54b978c7d2b292b3928.tmp
<Current directory>\$dpx$.tmp\04c3697e9688614188ca8ef47e854a07.tmp
<Current directory>\$dpx$.tmp\6fc9865be43fbb4280f9887daa9ef62c.tmp
<Current directory>\$dpx$.tmp\2bdb673b224b63498fc3ad2fcb0e17ff.tmp
<Current directory>\$dpx$.tmp\f8abff41e2b14e408c126a9b3b94f28f.tmp
<Current directory>\$dpx$.tmp\39fa04c0463d4d41af64327cea03edcf.tmp
<Current directory>\$dpx$.tmp\e4600a0ffa0a5a4fb5510bad4c19c93c.tmp
<Current directory>\$dpx$.tmp\868dd1b2b5393d4aa76b4898394bfe90.tmp
<Current directory>\$dpx$.tmp\5d7787491098f847874f03cb617289a4.tmp
<Current directory>\$dpx$.tmp\d68fabce0625f5448d87b1c864735abe.tmp
<Current directory>\$dpx$.tmp\c72f913c941fe646bcb18adabb83c4ee.tmp
<Current directory>\$dpx$.tmp\99484ed3477ed44fb1ac230a58451b45.tmp
<Current directory>\$dpx$.tmp\d29460d027ea7344ac84f82651cd5c37.tmp
<Current directory>\$dpx$.tmp\c53e1d4e650a0c42a3660f4d6950a7e7.tmp
<Current directory>\$dpx$.tmp\648fc3a0773c704f8c80c1ac6fb5983a.tmp
<Current directory>\$dpx$.tmp\73236fe605bf254599b5fe5cb49ab9db.tmp
<Current directory>\$dpx$.tmp\c3044a161231e24b8586ba4f64be1649.tmp
<Current directory>\$dpx$.tmp\e2df9ab3fe47fd4aba584540e1364668.tmp
<Current directory>\$dpx$.tmp\d10b13e8774b4947ac1897f417381891.tmp
<Current directory>\$dpx$.tmp\37686d3a5806bc4abaa87dbe3397f71a.tmp
<Current directory>\$dpx$.tmp\9938ec616e24f4479e13221d56fb5b71.tmp
<Current directory>\$dpx$.tmp\aa4fec96f32af34d8c49e80459a7755b.tmp
<Current directory>\$dpx$.tmp\cd44654eb805ac43af92cf3cb7ebce69.tmp
<Current directory>\$dpx$.tmp\245cf8cf0dfd6742b17677f7bdeb8375.tmp
<Current directory>\$dpx$.tmp\e1390316c0e51b40af50894674d156cb.tmp
<Current directory>\$dpx$.tmp\2684383cc6f63d449a598860874f429c.tmp
<Current directory>\$dpx$.tmp\568890db2a828b409c0e7c5a3d433807.tmp
<Current directory>\$dpx$.tmp\69a552dc1a5a7d48b1d6ab3b6115fabd.tmp
<Current directory>\$dpx$.tmp\d339a60fa0687945a9c263f296ff87fa.tmp
<Current directory>\$dpx$.tmp\551a2381fced6942af170f6ee05177c7.tmp
<Current directory>\$dpx$.tmp\ca53b705647f8048b858361395c69060.tmp
<Current directory>\$dpx$.tmp\1c4dbdefde7adf47951694e23ddc1988.tmp
<Current directory>\$dpx$.tmp\40dceb1243b1f54f879094240d989f1a.tmp
<Current directory>\$dpx$.tmp\0b4eb430d4b849429d6ba936524da822.tmp
<Current directory>\$dpx$.tmp\9e491101e6fc5f4e98da30c13fd6fda5.tmp
<Current directory>\$dpx$.tmp\bbfdf6c8eb064a498a832dc475f51209.tmp
<Current directory>\$dpx$.tmp\f1da4ad9c8806348add1791b18f1a944.tmp
<Current directory>\$dpx$.tmp\000a3eaddb298343a82f86c246529195.tmp
<Current directory>\$dpx$.tmp\505fe46aa091e749b1a2fc3a15ad4ba7.tmp
<Current directory>\$dpx$.tmp\dae38e3d514f954c837570b859762d70.tmp
<Current directory>\$dpx$.tmp\e2b5d9a055e96144b0f989f89050382f.tmp
<Current directory>\$dpx$.tmp\c1e63516e2944048af1461d502f545f0.tmp
<Current directory>\$dpx$.tmp\15bb894658370a4b8441f844c9818ebd.tmp
<Current directory>\$dpx$.tmp\60315ddc93dc18478ad5b2e0c8c72d19.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\245cf8cf0dfd6742b17677f7bdeb8375.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6fc9865be43fbb4280f9887daa9ef62c.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2bdb673b224b63498fc3ad2fcb0e17ff.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f8abff41e2b14e408c126a9b3b94f28f.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\39fa04c0463d4d41af64327cea03edcf.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e4600a0ffa0a5a4fb5510bad4c19c93c.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\868dd1b2b5393d4aa76b4898394bfe90.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5d7787491098f847874f03cb617289a4.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f4acf6b78717b54b978c7d2b292b3928.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\04c3697e9688614188ca8ef47e854a07.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d68fabce0625f5448d87b1c864735abe.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d29460d027ea7344ac84f82651cd5c37.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c53e1d4e650a0c42a3660f4d6950a7e7.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\648fc3a0773c704f8c80c1ac6fb5983a.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\73236fe605bf254599b5fe5cb49ab9db.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c3044a161231e24b8586ba4f64be1649.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e2df9ab3fe47fd4aba584540e1364668.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\d10b13e8774b4947ac1897f417381891.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\c72f913c941fe646bcb18adabb83c4ee.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\99484ed3477ed44fb1ac230a58451b45.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\37686d3a5806bc4abaa87dbe3397f71a.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\aa4fec96f32af34d8c49e80459a7755b.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\15bb894658370a4b8441f844c9818ebd.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2684383cc6f63d449a598860874f429c.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\568890db2a828b409c0e7c5a3d433807.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\69a552dc1a5a7d48b1d6ab3b6115fabd.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d339a60fa0687945a9c263f296ff87fa.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\551a2381fced6942af170f6ee05177c7.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\ca53b705647f8048b858361395c69060.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1c4dbdefde7adf47951694e23ddc1988.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\40dceb1243b1f54f879094240d989f1a.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e1390316c0e51b40af50894674d156cb.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0b4eb430d4b849429d6ba936524da822.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bbfdf6c8eb064a498a832dc475f51209.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f1da4ad9c8806348add1791b18f1a944.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\000a3eaddb298343a82f86c246529195.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\505fe46aa091e749b1a2fc3a15ad4ba7.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\dae38e3d514f954c837570b859762d70.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\e2b5d9a055e96144b0f989f89050382f.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c1e63516e2944048af1461d502f545f0.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cd44654eb805ac43af92cf3cb7ebce69.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9e491101e6fc5f4e98da30c13fd6fda5.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\9938ec616e24f4479e13221d56fb5b71.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\60315ddc93dc18478ad5b2e0c8c72d19.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443
'lp##.haqo.net':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней