Trojan.DownLoader33.14056

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\ba0434f2b23c4e4084f0de09df2e370f.tmp
<Current directory>\$dpx$.tmp\5d9a91b551445d4f9cb9f3c827f469e9.tmp
<Current directory>\$dpx$.tmp\af2db2cafc652c479e721c39a35c63f8.tmp
<Current directory>\$dpx$.tmp\1968bc1959e6ae43b7d0678276e39ac0.tmp
<Current directory>\$dpx$.tmp\f808b9bbb767af40815e984362d0ca04.tmp
<Current directory>\$dpx$.tmp\afcd6e0fc8cee04c818a7fa01c62fc74.tmp
<Current directory>\$dpx$.tmp\b16a055337c56643b5cb140cea8ad018.tmp
<Current directory>\$dpx$.tmp\363fc27d2da7ad4eb3a1c2087963bfc0.tmp
<Current directory>\$dpx$.tmp\c269fdb2bc12ff40acb50de741f2f097.tmp
<Current directory>\$dpx$.tmp\f7e753b5efd9a64498f45e8976c15057.tmp
<Current directory>\$dpx$.tmp\d18682513e1e934b8779e5e4abc3ab04.tmp
<Current directory>\$dpx$.tmp\ac106b6c2b29ca48a39b43c097228679.tmp
<Current directory>\$dpx$.tmp\379e4d8b883610428ce0d13b89a0f0d4.tmp
<Current directory>\$dpx$.tmp\e98e9f9b2897614d89ae7e81df2f02dd.tmp
<Current directory>\$dpx$.tmp\c01f64717d61854da4b5b79a685f3c61.tmp
<Current directory>\$dpx$.tmp\764f86c7e45860468d0f63cdaecc7c04.tmp
<Current directory>\$dpx$.tmp\726060c97194be41a8a5d5373555137d.tmp
<Current directory>\$dpx$.tmp\68d58a418f74954db41883e75e07c3a6.tmp
<Current directory>\$dpx$.tmp\51f86c5decb4834cb7744a850dfeaf29.tmp
<Current directory>\$dpx$.tmp\8804ab451df5454b89d618aff283950f.tmp
<Current directory>\$dpx$.tmp\4bb0d72dd179d5409b1a2853f3c765fa.tmp
<Current directory>\$dpx$.tmp\2a05e4dbce3db84689c4199ffa3d01e7.tmp
<Current directory>\$dpx$.tmp\e506509e0a38dc42891f4584a77ac391.tmp
<Current directory>\$dpx$.tmp\b82533278c92874ca782446520f31085.tmp
<Current directory>\$dpx$.tmp\68b861b95645034a866789ae15a921ed.tmp
<Current directory>\$dpx$.tmp\98aa3ef315cb374492c5ab9df2d0732e.tmp
<Current directory>\$dpx$.tmp\8e6418747ba780479d471153b3b418e5.tmp
<Current directory>\$dpx$.tmp\307058c06bb31a45b5db061ad1e1ee5a.tmp
<Current directory>\$dpx$.tmp\dc37a052bd288c49bcfe7b7b965b7434.tmp
<Current directory>\$dpx$.tmp\31f9171d984aff42a98158b842898fee.tmp
<Current directory>\$dpx$.tmp\72c2c082bda330459a871ce7f21dc5c4.tmp
<Current directory>\$dpx$.tmp\acaccd5810d3ee42bc6cb2ad6e67c55f.tmp
<Current directory>\$dpx$.tmp\e375e03ae629c14e86fdce9825c0176a.tmp
<Current directory>\$dpx$.tmp\5fc2d1410d5239499f8f159b7d174355.tmp
<Current directory>\$dpx$.tmp\74b7eb551690f04297f5f0a743c5a74e.tmp
<Current directory>\$dpx$.tmp\02109f89b8eaf04787ac900540fface5.tmp
<Current directory>\$dpx$.tmp\3b017a2d7c4c264ba1364b8088a7abdc.tmp
<Current directory>\$dpx$.tmp\72cf610767c104499b744d68052a6c5f.tmp
<Current directory>\$dpx$.tmp\a5ba00184ffa3e44a0828088ccdb5981.tmp
<Current directory>\$dpx$.tmp\fe5d74629677f74ab79e9445f8d3d05e.tmp
<Current directory>\$dpx$.tmp\ccba61d44961ca4c877a9eb840976a67.tmp
<Current directory>\$dpx$.tmp\c3b2aa349523e14585e204d105389de2.tmp
<Current directory>\$dpx$.tmp\da8c1357bf5b5641acbfc134bf0868ac.tmp
<Current directory>\$dpx$.tmp\b6dd019f08f0714ab7aa9888abef7292.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\b82533278c92874ca782446520f31085.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\af2db2cafc652c479e721c39a35c63f8.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1968bc1959e6ae43b7d0678276e39ac0.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f808b9bbb767af40815e984362d0ca04.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\afcd6e0fc8cee04c818a7fa01c62fc74.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b16a055337c56643b5cb140cea8ad018.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\363fc27d2da7ad4eb3a1c2087963bfc0.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c269fdb2bc12ff40acb50de741f2f097.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ba0434f2b23c4e4084f0de09df2e370f.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5d9a91b551445d4f9cb9f3c827f469e9.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f7e753b5efd9a64498f45e8976c15057.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\379e4d8b883610428ce0d13b89a0f0d4.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e98e9f9b2897614d89ae7e81df2f02dd.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c01f64717d61854da4b5b79a685f3c61.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\764f86c7e45860468d0f63cdaecc7c04.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\726060c97194be41a8a5d5373555137d.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\68d58a418f74954db41883e75e07c3a6.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\51f86c5decb4834cb7744a850dfeaf29.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\d18682513e1e934b8779e5e4abc3ab04.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ac106b6c2b29ca48a39b43c097228679.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8804ab451df5454b89d618aff283950f.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2a05e4dbce3db84689c4199ffa3d01e7.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\da8c1357bf5b5641acbfc134bf0868ac.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\98aa3ef315cb374492c5ab9df2d0732e.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8e6418747ba780479d471153b3b418e5.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\307058c06bb31a45b5db061ad1e1ee5a.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\dc37a052bd288c49bcfe7b7b965b7434.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\31f9171d984aff42a98158b842898fee.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\72c2c082bda330459a871ce7f21dc5c4.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\acaccd5810d3ee42bc6cb2ad6e67c55f.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e375e03ae629c14e86fdce9825c0176a.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\68b861b95645034a866789ae15a921ed.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5fc2d1410d5239499f8f159b7d174355.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\02109f89b8eaf04787ac900540fface5.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3b017a2d7c4c264ba1364b8088a7abdc.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\72cf610767c104499b744d68052a6c5f.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a5ba00184ffa3e44a0828088ccdb5981.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fe5d74629677f74ab79e9445f8d3d05e.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\ccba61d44961ca4c877a9eb840976a67.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c3b2aa349523e14585e204d105389de2.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e506509e0a38dc42891f4584a77ac391.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\74b7eb551690f04297f5f0a743c5a74e.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\4bb0d72dd179d5409b1a2853f3c765fa.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\b6dd019f08f0714ab7aa9888abef7292.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней