Trojan.DownLoader33.12717

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\bf3d91667a69a64798bcd8748533e6bb.tmp
<Current directory>\$dpx$.tmp\6391b37fddff1d4483305ee475ddf3e7.tmp
<Current directory>\$dpx$.tmp\a4c3ddc471b9164c901c57bf85ecfaf4.tmp
<Current directory>\$dpx$.tmp\fad589e8c4a6854dbdb3a56e5635c4c6.tmp
<Current directory>\$dpx$.tmp\abb71443e123fc479c5e4e055d9d7ee2.tmp
<Current directory>\$dpx$.tmp\0717eb211185df47b6d36ff7bb845437.tmp
<Current directory>\$dpx$.tmp\681be3d9b5b4f345a6df2fa587b1dfa7.tmp
<Current directory>\$dpx$.tmp\deb84796966d4e44b6902244e37344f1.tmp
<Current directory>\$dpx$.tmp\a8908dc6f1764944bde6dc0ce877abec.tmp
<Current directory>\$dpx$.tmp\8384ca4135b491458decb4826a345e89.tmp
<Current directory>\$dpx$.tmp\b8c6b1dc6270c847ba78634cade7a871.tmp
<Current directory>\$dpx$.tmp\3641de146e2b5541b7edb38db27eca3f.tmp
<Current directory>\$dpx$.tmp\4b9e30d63fa01a45bbeaf371a25e3e98.tmp
<Current directory>\$dpx$.tmp\4d9fae109968434a97ef6a2dcf25f84b.tmp
<Current directory>\$dpx$.tmp\53b5a9da70d36545a4001dbaa0f1ea60.tmp
<Current directory>\$dpx$.tmp\0c7dc3178063bb44a879912d12021e9c.tmp
<Current directory>\$dpx$.tmp\aa8599b54ef0004095a998dda9a2db3f.tmp
<Current directory>\$dpx$.tmp\382ca1c60f9ee34394ef75ea51e2450f.tmp
<Current directory>\$dpx$.tmp\c998b94f1587a346b6ef55a04a8314eb.tmp
<Current directory>\$dpx$.tmp\7d3e28de442a58469cf5bab516f2fabe.tmp
<Current directory>\$dpx$.tmp\2ed95e690d90134b9880e27dcf7593e2.tmp
<Current directory>\$dpx$.tmp\c6dd76219af790439668af545c6c1b7c.tmp
<Current directory>\$dpx$.tmp\0d437b91258ea342b472ff3f06c575fd.tmp
<Current directory>\$dpx$.tmp\7182845772a1fd468fdebd830d9dcaaa.tmp
<Current directory>\$dpx$.tmp\47bc505f35513b47ad82c6c5d8a81394.tmp
<Current directory>\$dpx$.tmp\adefcfd5c6c83a44bff885d78315ef70.tmp
<Current directory>\$dpx$.tmp\c8007c3e04b1c542aa97ba20380f48e2.tmp
<Current directory>\$dpx$.tmp\275c6c35a2d48549ab37710215fd9057.tmp
<Current directory>\$dpx$.tmp\82d880d3637dfb4cb5c312ffb5068147.tmp
<Current directory>\$dpx$.tmp\d575b0bbd23952488a25662a3be9d94a.tmp
<Current directory>\$dpx$.tmp\3b404f48da6fdc4ead06c19e643bff19.tmp
<Current directory>\$dpx$.tmp\5f304f1da7380140bdc2c53f0702cee6.tmp
<Current directory>\$dpx$.tmp\fe6b67b4dc7d7e418f3a41969a9669e7.tmp
<Current directory>\$dpx$.tmp\e7381f04e778074da2c0b142b83c90f0.tmp
<Current directory>\$dpx$.tmp\e4886a8ae67ad14f8a602e74c7bef87b.tmp
<Current directory>\$dpx$.tmp\efdcc8bd6260804b9e7c570cbebfe54d.tmp
<Current directory>\$dpx$.tmp\409b3515807abe44a88599234271f73c.tmp
<Current directory>\$dpx$.tmp\bdfad41b39bdcb4fb0456ab81a129fce.tmp
<Current directory>\$dpx$.tmp\a49e70c44f6a654693c2bdb09fd7a764.tmp
<Current directory>\$dpx$.tmp\e52f2d7d8d169944bf796e9aab44c822.tmp
<Current directory>\$dpx$.tmp\97fb9f5a1803a4429d7c4e5227ed71d7.tmp
<Current directory>\$dpx$.tmp\2310de38c14a1e44a1a05c381bebcf6f.tmp
<Current directory>\$dpx$.tmp\bfefcc812802f04cb1515ca783a9cd6b.tmp
<Current directory>\$dpx$.tmp\4d92cde7bfd8c447bbaa34a0c4563e8c.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\7182845772a1fd468fdebd830d9dcaaa.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a4c3ddc471b9164c901c57bf85ecfaf4.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fad589e8c4a6854dbdb3a56e5635c4c6.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\abb71443e123fc479c5e4e055d9d7ee2.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0717eb211185df47b6d36ff7bb845437.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\681be3d9b5b4f345a6df2fa587b1dfa7.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\deb84796966d4e44b6902244e37344f1.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a8908dc6f1764944bde6dc0ce877abec.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bf3d91667a69a64798bcd8748533e6bb.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6391b37fddff1d4483305ee475ddf3e7.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8384ca4135b491458decb4826a345e89.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4b9e30d63fa01a45bbeaf371a25e3e98.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4d9fae109968434a97ef6a2dcf25f84b.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\53b5a9da70d36545a4001dbaa0f1ea60.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0c7dc3178063bb44a879912d12021e9c.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\aa8599b54ef0004095a998dda9a2db3f.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\382ca1c60f9ee34394ef75ea51e2450f.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\c998b94f1587a346b6ef55a04a8314eb.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\b8c6b1dc6270c847ba78634cade7a871.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3641de146e2b5541b7edb38db27eca3f.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7d3e28de442a58469cf5bab516f2fabe.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c6dd76219af790439668af545c6c1b7c.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\bfefcc812802f04cb1515ca783a9cd6b.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\adefcfd5c6c83a44bff885d78315ef70.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c8007c3e04b1c542aa97ba20380f48e2.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\275c6c35a2d48549ab37710215fd9057.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\82d880d3637dfb4cb5c312ffb5068147.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\d575b0bbd23952488a25662a3be9d94a.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\3b404f48da6fdc4ead06c19e643bff19.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5f304f1da7380140bdc2c53f0702cee6.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fe6b67b4dc7d7e418f3a41969a9669e7.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\47bc505f35513b47ad82c6c5d8a81394.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e7381f04e778074da2c0b142b83c90f0.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\efdcc8bd6260804b9e7c570cbebfe54d.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\409b3515807abe44a88599234271f73c.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bdfad41b39bdcb4fb0456ab81a129fce.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a49e70c44f6a654693c2bdb09fd7a764.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e52f2d7d8d169944bf796e9aab44c822.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\97fb9f5a1803a4429d7c4e5227ed71d7.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2310de38c14a1e44a1a05c381bebcf6f.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0d437b91258ea342b472ff3f06c575fd.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e4886a8ae67ad14f8a602e74c7bef87b.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\2ed95e690d90134b9880e27dcf7593e2.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\4d92cde7bfd8c447bbaa34a0c4563e8c.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней