Trojan.DownLoader33.196

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\1be7ab669c1c704f8e905905d03b05a8.tmp
<Current directory>\$dpx$.tmp\2e44ae9688eefa41879ef9ea4988ff73.tmp
<Current directory>\$dpx$.tmp\99263f0f54eeed45abde23b13057dbe2.tmp
<Current directory>\$dpx$.tmp\4a7df10737030047ad8504e73f13eaa4.tmp
<Current directory>\$dpx$.tmp\8e3d2b9fa42c01408ba649e2882414ad.tmp
<Current directory>\$dpx$.tmp\4294ee0c70c7e742acb3758a8a81188c.tmp
<Current directory>\$dpx$.tmp\b639483748a34c4184de850944c3fc43.tmp
<Current directory>\$dpx$.tmp\1c60e833e9bc7e4f82de5214e6e225f9.tmp
<Current directory>\$dpx$.tmp\3747197e2f9a57439129b985ebcaf191.tmp
<Current directory>\$dpx$.tmp\64ee12994e7c8f4481fd0314a8a33ab8.tmp
<Current directory>\$dpx$.tmp\7245be2d54e8e54d85920b8ea6639511.tmp
<Current directory>\$dpx$.tmp\4892163265cef940bfbda8bbfe27057b.tmp
<Current directory>\$dpx$.tmp\c432eb5e7cb35b47bdaad5f9ee4f61e4.tmp
<Current directory>\$dpx$.tmp\c52ab888e5df8c409e2fd1336ec703b6.tmp
<Current directory>\$dpx$.tmp\a1de3ba4a097824cb2767dc72a589fa9.tmp
<Current directory>\$dpx$.tmp\c87140d54568fe44a0657c80365a9e7d.tmp
<Current directory>\$dpx$.tmp\27c9e5f80c81ca45881945963ff1a1c6.tmp
<Current directory>\$dpx$.tmp\8547e9f14f6727468f4aaf2a6a8d879d.tmp
<Current directory>\$dpx$.tmp\ba595b62420b1b499ac60c64ee3990c4.tmp
<Current directory>\$dpx$.tmp\dd908b2b652fb9448e2477319bf92c15.tmp
<Current directory>\$dpx$.tmp\a7bcb167c2acdf4caac816aaf357dcd0.tmp
<Current directory>\$dpx$.tmp\032ded8958f38745a28a81dc6d66201c.tmp
<Current directory>\$dpx$.tmp\335c708eba49bc4aa92386d1c17c8539.tmp
<Current directory>\$dpx$.tmp\5cdfda9320fa2c4d9421f5746bc47a65.tmp
<Current directory>\$dpx$.tmp\30cf0e231a347f4bb183d6ac3e6c80bd.tmp
<Current directory>\$dpx$.tmp\92f4130c083c7c479fce3d1abf33e4e1.tmp
<Current directory>\$dpx$.tmp\e057620994eaa046ae596ee6e38d70db.tmp
<Current directory>\$dpx$.tmp\6426cb8abfa8dd449c4db29596f9fbe3.tmp
<Current directory>\$dpx$.tmp\6f93909bc608574a93346b4a81f3038e.tmp
<Current directory>\$dpx$.tmp\f05e4e83dcdb3947a3bf2e5564deefc5.tmp
<Current directory>\$dpx$.tmp\a33323e9a84b784bae2fc44f4e164a78.tmp
<Current directory>\$dpx$.tmp\71f8a91e84c01947bd975c272f6991dd.tmp
<Current directory>\$dpx$.tmp\0d8fc3231f1b804592bc526610ed36b6.tmp
<Current directory>\$dpx$.tmp\4ef921ccff1a0c4da814818ffae5cafd.tmp
<Current directory>\$dpx$.tmp\8069dc3d6d783e4dbd29a49ad5b5ab65.tmp
<Current directory>\$dpx$.tmp\7fa1420705fe6943ab7059ccf889a15b.tmp
<Current directory>\$dpx$.tmp\73f18878c510814c89f25c536c3772e9.tmp
<Current directory>\$dpx$.tmp\86390ab0539d934ba301a09a1718d0ab.tmp
<Current directory>\$dpx$.tmp\7a155c575a6fa84591cbef266bd6208e.tmp
<Current directory>\$dpx$.tmp\e9dd7912a109e24288c350b2b20a4bd6.tmp
<Current directory>\$dpx$.tmp\77cc56b3abc3144a979b73ca6da132c0.tmp
<Current directory>\$dpx$.tmp\9532874b9f518c4d9f9c181d5a8af712.tmp
<Current directory>\$dpx$.tmp\5524749af2cb5f449e92f12c966d73b4.tmp
<Current directory>\$dpx$.tmp\094669cf0094c141b3cb526c8fc0782e.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\5cdfda9320fa2c4d9421f5746bc47a65.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\99263f0f54eeed45abde23b13057dbe2.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4a7df10737030047ad8504e73f13eaa4.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8e3d2b9fa42c01408ba649e2882414ad.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4294ee0c70c7e742acb3758a8a81188c.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b639483748a34c4184de850944c3fc43.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1c60e833e9bc7e4f82de5214e6e225f9.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3747197e2f9a57439129b985ebcaf191.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1be7ab669c1c704f8e905905d03b05a8.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2e44ae9688eefa41879ef9ea4988ff73.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\64ee12994e7c8f4481fd0314a8a33ab8.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c432eb5e7cb35b47bdaad5f9ee4f61e4.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c52ab888e5df8c409e2fd1336ec703b6.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a1de3ba4a097824cb2767dc72a589fa9.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c87140d54568fe44a0657c80365a9e7d.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\27c9e5f80c81ca45881945963ff1a1c6.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8547e9f14f6727468f4aaf2a6a8d879d.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\ba595b62420b1b499ac60c64ee3990c4.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\7245be2d54e8e54d85920b8ea6639511.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4892163265cef940bfbda8bbfe27057b.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\dd908b2b652fb9448e2477319bf92c15.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\032ded8958f38745a28a81dc6d66201c.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\5524749af2cb5f449e92f12c966d73b4.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\92f4130c083c7c479fce3d1abf33e4e1.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e057620994eaa046ae596ee6e38d70db.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6426cb8abfa8dd449c4db29596f9fbe3.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6f93909bc608574a93346b4a81f3038e.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\f05e4e83dcdb3947a3bf2e5564deefc5.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\a33323e9a84b784bae2fc44f4e164a78.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\71f8a91e84c01947bd975c272f6991dd.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0d8fc3231f1b804592bc526610ed36b6.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\30cf0e231a347f4bb183d6ac3e6c80bd.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4ef921ccff1a0c4da814818ffae5cafd.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7fa1420705fe6943ab7059ccf889a15b.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\73f18878c510814c89f25c536c3772e9.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\86390ab0539d934ba301a09a1718d0ab.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7a155c575a6fa84591cbef266bd6208e.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e9dd7912a109e24288c350b2b20a4bd6.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\77cc56b3abc3144a979b73ca6da132c0.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9532874b9f518c4d9f9c181d5a8af712.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\335c708eba49bc4aa92386d1c17c8539.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8069dc3d6d783e4dbd29a49ad5b5ab65.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\a7bcb167c2acdf4caac816aaf357dcd0.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\094669cf0094c141b3cb526c8fc0782e.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443
'lp##.haqo.net':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней