Trojan.DownLoader33.12638

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\2298c35ae0786b4a9444651e4119740b.tmp
<Current directory>\$dpx$.tmp\6bffe4cde58f77469818fce4cbac5ff4.tmp
<Current directory>\$dpx$.tmp\a8e67a5d750c9d4a85321548832e814a.tmp
<Current directory>\$dpx$.tmp\25f0b8c9442e0743bb5199c471fca745.tmp
<Current directory>\$dpx$.tmp\bf88bcb3f8c8a1409b15dcd8f0a2bcbc.tmp
<Current directory>\$dpx$.tmp\c2b56fffea17fa458784cadba34ab298.tmp
<Current directory>\$dpx$.tmp\06b2db19b1d1c8418a7c9489d8fd05dc.tmp
<Current directory>\$dpx$.tmp\5ffc0266e515154ea5b6977a4af97886.tmp
<Current directory>\$dpx$.tmp\bda09437de149e4a8d721f45f408f328.tmp
<Current directory>\$dpx$.tmp\4d9ed0c448ac7a4eaf57df8b67649d91.tmp
<Current directory>\$dpx$.tmp\1589a64789b1d446953e79f38c911d0c.tmp
<Current directory>\$dpx$.tmp\dbfa617504f2cf43959cf4686b5a568c.tmp
<Current directory>\$dpx$.tmp\c1ccfecda0c6584298739d9d70f43819.tmp
<Current directory>\$dpx$.tmp\1cc182f2c04e784393d11a26ec2de7d6.tmp
<Current directory>\$dpx$.tmp\6e1467ebda811940ba44b8c986a50b22.tmp
<Current directory>\$dpx$.tmp\866bdf0a57c8dc44bd87988db7773401.tmp
<Current directory>\$dpx$.tmp\4fabdfc39419fc488a45c5bd6bad7ba3.tmp
<Current directory>\$dpx$.tmp\42834a225ddd114ebf4bc24a2510c200.tmp
<Current directory>\$dpx$.tmp\6b603ed61315114197a54ce0ab6cfe7a.tmp
<Current directory>\$dpx$.tmp\0119e35b349a2a4ea20c66878e49f6d6.tmp
<Current directory>\$dpx$.tmp\d3bd2e932149f04181a58b0c5f3ee565.tmp
<Current directory>\$dpx$.tmp\11191eef34573743b2f785d87c5d13f1.tmp
<Current directory>\$dpx$.tmp\5118964bf9cd4444a1cce6944af38f55.tmp
<Current directory>\$dpx$.tmp\d6d041d6c3fbe348a5cd5f45248816a7.tmp
<Current directory>\$dpx$.tmp\cded9cd0290bd644b1f313d757f44d7e.tmp
<Current directory>\$dpx$.tmp\a313536a953a8c4c88251d8da8e20732.tmp
<Current directory>\$dpx$.tmp\ab40225870d9db419c92b2b82384dc89.tmp
<Current directory>\$dpx$.tmp\11032ca9563e1c4dbc351069f01869a4.tmp
<Current directory>\$dpx$.tmp\53c96be96b9765409ea4bf8d98ff8313.tmp
<Current directory>\$dpx$.tmp\57245b312531a648ac650668c7cd2f69.tmp
<Current directory>\$dpx$.tmp\21a3ed0c29dbcb41bd77582ffd64ff85.tmp
<Current directory>\$dpx$.tmp\de330bac788612418c989e4d041f3173.tmp
<Current directory>\$dpx$.tmp\16598b4ad53efb418624d543697b8800.tmp
<Current directory>\$dpx$.tmp\c8d25dc418c81b459c80dbb690508a5a.tmp
<Current directory>\$dpx$.tmp\7c7f6a6a32e50445a91a60d89f66d013.tmp
<Current directory>\$dpx$.tmp\75bb3e9d3a57a04e9f6b6984d8e4b31c.tmp
<Current directory>\$dpx$.tmp\cb63696f92b2b5409e71fb71e3249b14.tmp
<Current directory>\$dpx$.tmp\d4cd2305cbb0724ea61ea5f4558fecbd.tmp
<Current directory>\$dpx$.tmp\65010ff813fc7f4a96cec79f0dbc14f1.tmp
<Current directory>\$dpx$.tmp\e38db44e7d0f7941a9c4a7da433653d4.tmp
<Current directory>\$dpx$.tmp\2af8e03f9a154b4d977da21e143ab896.tmp
<Current directory>\$dpx$.tmp\61b5fa10f2bf6f4a919dd6bd03fafa23.tmp
<Current directory>\$dpx$.tmp\d6a2d7be6be39e4d80304cf34109546b.tmp
<Current directory>\$dpx$.tmp\fa5be0a76b436045b349aaf88bdefa44.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\d6d041d6c3fbe348a5cd5f45248816a7.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a8e67a5d750c9d4a85321548832e814a.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\25f0b8c9442e0743bb5199c471fca745.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bf88bcb3f8c8a1409b15dcd8f0a2bcbc.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c2b56fffea17fa458784cadba34ab298.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\06b2db19b1d1c8418a7c9489d8fd05dc.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5ffc0266e515154ea5b6977a4af97886.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bda09437de149e4a8d721f45f408f328.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2298c35ae0786b4a9444651e4119740b.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6bffe4cde58f77469818fce4cbac5ff4.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4d9ed0c448ac7a4eaf57df8b67649d91.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c1ccfecda0c6584298739d9d70f43819.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1cc182f2c04e784393d11a26ec2de7d6.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6e1467ebda811940ba44b8c986a50b22.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\866bdf0a57c8dc44bd87988db7773401.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4fabdfc39419fc488a45c5bd6bad7ba3.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\42834a225ddd114ebf4bc24a2510c200.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\6b603ed61315114197a54ce0ab6cfe7a.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\1589a64789b1d446953e79f38c911d0c.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\dbfa617504f2cf43959cf4686b5a568c.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0119e35b349a2a4ea20c66878e49f6d6.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\11191eef34573743b2f785d87c5d13f1.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\d6a2d7be6be39e4d80304cf34109546b.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a313536a953a8c4c88251d8da8e20732.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ab40225870d9db419c92b2b82384dc89.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\11032ca9563e1c4dbc351069f01869a4.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\53c96be96b9765409ea4bf8d98ff8313.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\57245b312531a648ac650668c7cd2f69.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\21a3ed0c29dbcb41bd77582ffd64ff85.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\de330bac788612418c989e4d041f3173.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\16598b4ad53efb418624d543697b8800.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cded9cd0290bd644b1f313d757f44d7e.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c8d25dc418c81b459c80dbb690508a5a.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\75bb3e9d3a57a04e9f6b6984d8e4b31c.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cb63696f92b2b5409e71fb71e3249b14.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d4cd2305cbb0724ea61ea5f4558fecbd.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\65010ff813fc7f4a96cec79f0dbc14f1.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e38db44e7d0f7941a9c4a7da433653d4.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\2af8e03f9a154b4d977da21e143ab896.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\61b5fa10f2bf6f4a919dd6bd03fafa23.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5118964bf9cd4444a1cce6944af38f55.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7c7f6a6a32e50445a91a60d89f66d013.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\d3bd2e932149f04181a58b0c5f3ee565.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\fa5be0a76b436045b349aaf88bdefa44.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней