Trojan.DownLoader33.17083

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\c7d58168aafe574eb279e1adf1790647.tmp
<Current directory>\$dpx$.tmp\10eea9f185369a49b41503c03795a86f.tmp
<Current directory>\$dpx$.tmp\2d0fe2d1ed82fd489781acd1b89e77e1.tmp
<Current directory>\$dpx$.tmp\24df2e391b17ec48ae05ea15d8b233a3.tmp
<Current directory>\$dpx$.tmp\98cb0eed34c82141b5f11fe70de1efff.tmp
<Current directory>\$dpx$.tmp\966780a9575bb34ca8ced3900077c1fd.tmp
<Current directory>\$dpx$.tmp\4340bcf4b2ea4143a1ab637f5770c018.tmp
<Current directory>\$dpx$.tmp\974392a2c2580e46ad44fcccb2014879.tmp
<Current directory>\$dpx$.tmp\907df4b3b3f68640aafb67f277f29c8e.tmp
<Current directory>\$dpx$.tmp\2674d3cd944ab344bb312c6f6157fc9a.tmp
<Current directory>\$dpx$.tmp\c394f284ee6442488f6b6dee25d025ff.tmp
<Current directory>\$dpx$.tmp\edb428d2de49614cade8bff12aad9c32.tmp
<Current directory>\$dpx$.tmp\6da8c47e49ead74fb8a9b9eb282df113.tmp
<Current directory>\$dpx$.tmp\c073e2f2ce005d458facbd14454ec66e.tmp
<Current directory>\$dpx$.tmp\37eb64c97ed6d64693dd6eb9de6c9167.tmp
<Current directory>\$dpx$.tmp\2d27afb82e481c40bd289e8a739a64a9.tmp
<Current directory>\$dpx$.tmp\3083c8b705d32f4088702cbfef1f2261.tmp
<Current directory>\$dpx$.tmp\a978c7b0a0aa1b4bb7a2257b924187da.tmp
<Current directory>\$dpx$.tmp\6a2cba05829e8741b131e950de490f4d.tmp
<Current directory>\$dpx$.tmp\c54fad26332bdd4c959eed91f94abda6.tmp
<Current directory>\$dpx$.tmp\9c594ef9425e3f4589be000b559d8729.tmp
<Current directory>\$dpx$.tmp\38fe6e97e0cd194788dd77a9ae6316cf.tmp
<Current directory>\$dpx$.tmp\0d59904033544f4684a4350086f2eb1d.tmp
<Current directory>\$dpx$.tmp\8d85f0aac267c34297ab9ad9233abd05.tmp
<Current directory>\$dpx$.tmp\a5cde8f54ce8fa4aab72cf4bd1b1c912.tmp
<Current directory>\$dpx$.tmp\4ecac52bbc2cfe46a985c8a3122b16b2.tmp
<Current directory>\$dpx$.tmp\7c5d480716d4ac46a96624e8f7bf284e.tmp
<Current directory>\$dpx$.tmp\079bfa575e3a804584d97f4be9183a48.tmp
<Current directory>\$dpx$.tmp\b70cff8e9fe0e04b9be55a5b3db25a89.tmp
<Current directory>\$dpx$.tmp\0744808192fc3448a68e0c9c13e8e7ff.tmp
<Current directory>\$dpx$.tmp\db4bce7eb8edd74d84afc72c6bb397a7.tmp
<Current directory>\$dpx$.tmp\ff4d62504d94a64282193c6ee506b1b8.tmp
<Current directory>\$dpx$.tmp\541edaa007d9684b8f54781a1986a6ff.tmp
<Current directory>\$dpx$.tmp\2127b4868d0739438646a6992f3bdff7.tmp
<Current directory>\$dpx$.tmp\9bb5c63e4b036f41acc8f720364b5fc1.tmp
<Current directory>\$dpx$.tmp\2531c35380fcbd42a525c81f23217f7f.tmp
<Current directory>\$dpx$.tmp\d14ec2398151ce42942eb5a27e661350.tmp
<Current directory>\$dpx$.tmp\3fc01d82eea8c54fabbe66f04a44bdc0.tmp
<Current directory>\$dpx$.tmp\74e7a8c6bfa5a94691740c563b1564a4.tmp
<Current directory>\$dpx$.tmp\c9d0a93cedf1384ebe44103ea6a3bdb8.tmp
<Current directory>\$dpx$.tmp\03dec795c2020b4eac8d95f54d672ebc.tmp
<Current directory>\$dpx$.tmp\819450b88990e342bb13d211b73d83a5.tmp
<Current directory>\$dpx$.tmp\12b955c4b3b71848867f75542682224f.tmp
<Current directory>\$dpx$.tmp\528b54df77c00649b2979e303acf8ab5.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\8d85f0aac267c34297ab9ad9233abd05.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2d0fe2d1ed82fd489781acd1b89e77e1.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\24df2e391b17ec48ae05ea15d8b233a3.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\98cb0eed34c82141b5f11fe70de1efff.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\966780a9575bb34ca8ced3900077c1fd.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4340bcf4b2ea4143a1ab637f5770c018.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\974392a2c2580e46ad44fcccb2014879.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\907df4b3b3f68640aafb67f277f29c8e.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c7d58168aafe574eb279e1adf1790647.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\10eea9f185369a49b41503c03795a86f.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2674d3cd944ab344bb312c6f6157fc9a.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6da8c47e49ead74fb8a9b9eb282df113.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c073e2f2ce005d458facbd14454ec66e.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\37eb64c97ed6d64693dd6eb9de6c9167.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2d27afb82e481c40bd289e8a739a64a9.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3083c8b705d32f4088702cbfef1f2261.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a978c7b0a0aa1b4bb7a2257b924187da.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\6a2cba05829e8741b131e950de490f4d.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\c394f284ee6442488f6b6dee25d025ff.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\edb428d2de49614cade8bff12aad9c32.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c54fad26332bdd4c959eed91f94abda6.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\38fe6e97e0cd194788dd77a9ae6316cf.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\12b955c4b3b71848867f75542682224f.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4ecac52bbc2cfe46a985c8a3122b16b2.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7c5d480716d4ac46a96624e8f7bf284e.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\079bfa575e3a804584d97f4be9183a48.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b70cff8e9fe0e04b9be55a5b3db25a89.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\0744808192fc3448a68e0c9c13e8e7ff.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\db4bce7eb8edd74d84afc72c6bb397a7.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ff4d62504d94a64282193c6ee506b1b8.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\541edaa007d9684b8f54781a1986a6ff.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a5cde8f54ce8fa4aab72cf4bd1b1c912.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2127b4868d0739438646a6992f3bdff7.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2531c35380fcbd42a525c81f23217f7f.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d14ec2398151ce42942eb5a27e661350.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3fc01d82eea8c54fabbe66f04a44bdc0.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\74e7a8c6bfa5a94691740c563b1564a4.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c9d0a93cedf1384ebe44103ea6a3bdb8.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\03dec795c2020b4eac8d95f54d672ebc.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\819450b88990e342bb13d211b73d83a5.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0d59904033544f4684a4350086f2eb1d.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9bb5c63e4b036f41acc8f720364b5fc1.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\9c594ef9425e3f4589be000b559d8729.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\528b54df77c00649b2979e303acf8ab5.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней