Technical Information
Modifies file system
Creates the following files
- <Current directory>\d.cab
- <Current directory>\$dpx$.tmp\e87012f829c32044b029c2280068ec28.tmp
- <Current directory>\$dpx$.tmp\66f6d8e875aab14db34d07e1cf534140.tmp
- <Current directory>\$dpx$.tmp\ffec15f2b8108f418b95ebcca5c11c9b.tmp
- <Current directory>\$dpx$.tmp\fc8dbed41476b44685825583fd72af9a.tmp
- <Current directory>\$dpx$.tmp\88b9ef59a130e64e8131a6d180615cd7.tmp
- <Current directory>\$dpx$.tmp\34b07d0075322145b707f3a74ed9a656.tmp
- <Current directory>\$dpx$.tmp\c4463106e4d0924c856041e09882e7fb.tmp
- <Current directory>\$dpx$.tmp\3f0fff167d586745a73f44b95a74da4d.tmp
- <Current directory>\$dpx$.tmp\09887732682efd4ea7bb23aa4591cd6d.tmp
- <Current directory>\$dpx$.tmp\c47619a0bcf12f4fabdbce72fb2a438b.tmp
- <Current directory>\$dpx$.tmp\fef2f2f17d5eec41a301c2232a110b26.tmp
- <Current directory>\$dpx$.tmp\191eeb8ee663b7439ea7ee82359d33a1.tmp
- <Current directory>\$dpx$.tmp\a7daadfd2d9dda43ada4a0493ef5ddd3.tmp
- <Current directory>\$dpx$.tmp\5bc669275acdec4a9e28c358474be874.tmp
- <Current directory>\$dpx$.tmp\2052153b752004429e01f143ae6f51eb.tmp
- <Current directory>\$dpx$.tmp\6df71511c58e93458fd76398542c2b14.tmp
- <Current directory>\$dpx$.tmp\4fa68e5cd04fa04b94cadbb24d0fa0f2.tmp
- <Current directory>\$dpx$.tmp\265c58ef4f135048ad2fd02af5a82f15.tmp
- <Current directory>\$dpx$.tmp\7944a251abaeaf4aabd7c356b673149d.tmp
- <Current directory>\$dpx$.tmp\e8324cd5f2b1f842bdd095d0cbb3d027.tmp
- <Current directory>\$dpx$.tmp\c0503937a9e5f441998404d726f4d782.tmp
- <Current directory>\$dpx$.tmp\9c8fe4172d1ec04c9413e91f68e0f7d1.tmp
- <Current directory>\$dpx$.tmp\f23f59a4fe272f43a5552d421db410a2.tmp
- <Current directory>\$dpx$.tmp\43787a8fe6ab80499d4d8e3c9584d464.tmp
- <Current directory>\$dpx$.tmp\0fdcb0627230924694a50b62e3cb67cd.tmp
- <Current directory>\$dpx$.tmp\03b728e8c7eb994283770d671b029c03.tmp
- <Current directory>\$dpx$.tmp\6dd7bd70e36c414283fef900bfe8f19a.tmp
- <Current directory>\$dpx$.tmp\0e830ce594a9b94ebe1a2662e0b7634c.tmp
- <Current directory>\$dpx$.tmp\934d22a124665b4db4fda8eeee509b3f.tmp
- <Current directory>\$dpx$.tmp\7f203c6b5dc1f54ca5356ac19a1f4bd2.tmp
- <Current directory>\$dpx$.tmp\70e46f894cf95c4597b96b1fcae49e37.tmp
- <Current directory>\$dpx$.tmp\2fa7eeea5ae95844afca6058f58fcfe0.tmp
- <Current directory>\$dpx$.tmp\8a2c3d590e03e6439f2e3b276c89c076.tmp
- <Current directory>\$dpx$.tmp\1c85a47c6cbbc34b9fe09cba54bb6c6d.tmp
- <Current directory>\$dpx$.tmp\42eb80a5da368a419e5a4c9f000e6824.tmp
- <Current directory>\$dpx$.tmp\2325085817a73f4199b5d59363689027.tmp
- <Current directory>\$dpx$.tmp\7007357dc9b6944abe62b0ea1139bad6.tmp
- <Current directory>\$dpx$.tmp\8d42541042b230428bdf782530ee529a.tmp
- <Current directory>\$dpx$.tmp\d78ca11d718b1f48a4ffedc1b32be673.tmp
- <Current directory>\$dpx$.tmp\e259670ccf4cb44f92efd7bbc27ca984.tmp
- <Current directory>\$dpx$.tmp\690b1674aed5ae4e858aa7f6d40f3f1b.tmp
- <Current directory>\$dpx$.tmp\d26066cf0771134185c2d6695487a3ec.tmp
- <Current directory>\$dpx$.tmp\a325757a2290c04482ff7440ddd54952.tmp
- <Current directory>\$dpx$.tmp\0f92daf552e4dc4f9b2a7bec04f8992e.tmp
Sets the 'hidden' attribute to the following files
- <Current directory>\api-ms-win-core-console-l1-1-0.dll
- <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
- <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
- <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
- <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
- <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
- <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
- <Current directory>\api-ms-win-crt-math-l1-1-0.dll
- <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
- <Current directory>\api-ms-win-core-util-l1-1-0.dll
- <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
- <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
- <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
- <Current directory>\api-ms-win-crt-string-l1-1-0.dll
- <Current directory>\api-ms-win-crt-time-l1-1-0.dll
- <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
- <Current directory>\msvcp140.dll
- <Current directory>\opencl.dll
- <Current directory>\api-ms-win-crt-private-l1-1-0.dll
- <Current directory>\api-ms-win-crt-process-l1-1-0.dll
- <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
- <Current directory>\api-ms-win-core-synch-l1-2-0.dll
- <Current directory>\api-ms-win-core-synch-l1-1-0.dll
- <Current directory>\api-ms-win-core-debug-l1-1-0.dll
- <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
- <Current directory>\api-ms-win-core-file-l1-1-0.dll
- <Current directory>\api-ms-win-core-file-l1-2-0.dll
- <Current directory>\api-ms-win-core-file-l2-1-0.dll
- <Current directory>\api-ms-win-core-handle-l1-1-0.dll
- <Current directory>\api-ms-win-core-heap-l1-1-0.dll
- <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
- <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
- <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
- <Current directory>\api-ms-win-core-memory-l1-1-0.dll
- <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
- <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
- <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
- <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
- <Current directory>\api-ms-win-core-profile-l1-1-0.dll
- <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
- <Current directory>\api-ms-win-core-string-l1-1-0.dll
- <Current directory>\api-ms-win-core-localization-l1-2-0.dll
- <Current directory>\ucrtbase.dll
- <Current directory>\vcruntime140.dll
Deletes the following files
- <Current directory>\d.cab
Moves the following files
- from <Current directory>\$dpx$.tmp\43787a8fe6ab80499d4d8e3c9584d464.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\ffec15f2b8108f418b95ebcca5c11c9b.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\fc8dbed41476b44685825583fd72af9a.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\88b9ef59a130e64e8131a6d180615cd7.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\34b07d0075322145b707f3a74ed9a656.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\c4463106e4d0924c856041e09882e7fb.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\3f0fff167d586745a73f44b95a74da4d.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\09887732682efd4ea7bb23aa4591cd6d.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\e87012f829c32044b029c2280068ec28.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\66f6d8e875aab14db34d07e1cf534140.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\c47619a0bcf12f4fabdbce72fb2a438b.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\a7daadfd2d9dda43ada4a0493ef5ddd3.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\5bc669275acdec4a9e28c358474be874.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\2052153b752004429e01f143ae6f51eb.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\6df71511c58e93458fd76398542c2b14.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\4fa68e5cd04fa04b94cadbb24d0fa0f2.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\265c58ef4f135048ad2fd02af5a82f15.tmp to <Current directory>\msvcp140.dll
- from <Current directory>\$dpx$.tmp\7944a251abaeaf4aabd7c356b673149d.tmp to <Current directory>\opencl.dll
- from <Current directory>\$dpx$.tmp\fef2f2f17d5eec41a301c2232a110b26.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\191eeb8ee663b7439ea7ee82359d33a1.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\e8324cd5f2b1f842bdd095d0cbb3d027.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\9c8fe4172d1ec04c9413e91f68e0f7d1.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
- from <Current directory>\$dpx$.tmp\a325757a2290c04482ff7440ddd54952.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\03b728e8c7eb994283770d671b029c03.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\6dd7bd70e36c414283fef900bfe8f19a.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\0e830ce594a9b94ebe1a2662e0b7634c.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\934d22a124665b4db4fda8eeee509b3f.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
- from <Current directory>\$dpx$.tmp\7f203c6b5dc1f54ca5356ac19a1f4bd2.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
- from <Current directory>\$dpx$.tmp\70e46f894cf95c4597b96b1fcae49e37.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\2fa7eeea5ae95844afca6058f58fcfe0.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\8a2c3d590e03e6439f2e3b276c89c076.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\0fdcb0627230924694a50b62e3cb67cd.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\1c85a47c6cbbc34b9fe09cba54bb6c6d.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\2325085817a73f4199b5d59363689027.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\7007357dc9b6944abe62b0ea1139bad6.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\8d42541042b230428bdf782530ee529a.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\d78ca11d718b1f48a4ffedc1b32be673.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\e259670ccf4cb44f92efd7bbc27ca984.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
- from <Current directory>\$dpx$.tmp\690b1674aed5ae4e858aa7f6d40f3f1b.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\d26066cf0771134185c2d6695487a3ec.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\f23f59a4fe272f43a5552d421db410a2.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
- from <Current directory>\$dpx$.tmp\42eb80a5da368a419e5a4c9f000e6824.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
- from <Current directory>\$dpx$.tmp\c0503937a9e5f441998404d726f4d782.tmp to <Current directory>\ucrtbase.dll
- from <Current directory>\$dpx$.tmp\0f92daf552e4dc4f9b2a7bec04f8992e.tmp to <Current directory>\vcruntime140.dll
Network activity
TCP
- 'lp##.abbny.com':443
- 'lp##.haqo.net':443
UDP
- DNS ASK lp##.beahh.com
- DNS ASK lp##.abbny.com
- DNS ASK lp##.haqo.net
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
- '<SYSTEM32>\expand.exe' d.cab -f:* .
