Trojan.DownLoader33.17089

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\7ecbbda5725f7e4a80267d72d232b81f.tmp
<Current directory>\$dpx$.tmp\a4317a241c18e542845a88a8ade598c5.tmp
<Current directory>\$dpx$.tmp\984f23e3243bd6489ad3ceb7e177fc66.tmp
<Current directory>\$dpx$.tmp\cff5f4ff609ab0459ecac45825e3dc38.tmp
<Current directory>\$dpx$.tmp\7269c78347fae444a8f4bb12d33c42d7.tmp
<Current directory>\$dpx$.tmp\c3e2a021bd90a54c91b0ff3b133b327d.tmp
<Current directory>\$dpx$.tmp\1a6b6131446f5146b4c9f610e561a6cd.tmp
<Current directory>\$dpx$.tmp\6da4e015f538c34a89db685a01a04683.tmp
<Current directory>\$dpx$.tmp\360d53f6f27fc34db17bd6229ca627d3.tmp
<Current directory>\$dpx$.tmp\3b4ffc39c584bf46bd39737b8d1b8b90.tmp
<Current directory>\$dpx$.tmp\a9210739fc8afa47bd5aca2883cc809c.tmp
<Current directory>\$dpx$.tmp\cd89de67c5ecf541a5c5a988153a24ce.tmp
<Current directory>\$dpx$.tmp\9fa1ac94c51cef468d6ff6e6cc315935.tmp
<Current directory>\$dpx$.tmp\46b4fa7e91092c43a8606841030f4cfb.tmp
<Current directory>\$dpx$.tmp\f3b85d9656783b42a6433c3e07fbb538.tmp
<Current directory>\$dpx$.tmp\9ffe72bd48990c44876fa726368ae537.tmp
<Current directory>\$dpx$.tmp\b805697e05d94946abbee4616c138d2b.tmp
<Current directory>\$dpx$.tmp\c7fc798de503824e82d7a684991acb8f.tmp
<Current directory>\$dpx$.tmp\3f9182135351124292768352972b3000.tmp
<Current directory>\$dpx$.tmp\6d5e7a3a38e4af4eae8728b52c51d777.tmp
<Current directory>\$dpx$.tmp\d242d9a65f8195479e18926a66e449c4.tmp
<Current directory>\$dpx$.tmp\a8efdf48fabee7468cfa192876086d06.tmp
<Current directory>\$dpx$.tmp\ae6e2ec39169574fbdca22198a8440ab.tmp
<Current directory>\$dpx$.tmp\fb1731842b3d51459223c2cad2a447de.tmp
<Current directory>\$dpx$.tmp\811b784856275b4b98a1392fffd215c7.tmp
<Current directory>\$dpx$.tmp\030c1322fddef6438da2feae8c9faf05.tmp
<Current directory>\$dpx$.tmp\ebb8ec9cc788ed46b44c1e0991bf93ab.tmp
<Current directory>\$dpx$.tmp\836f5b52518bde43aa7e19622fa66a44.tmp
<Current directory>\$dpx$.tmp\1a86646f00831d4095eb718946037958.tmp
<Current directory>\$dpx$.tmp\872e748d5828da4f904e6cb49fd32ad8.tmp
<Current directory>\$dpx$.tmp\c2efdc71b0abe7428798e9a433f2d255.tmp
<Current directory>\$dpx$.tmp\5d130b74d4c5c343a4bcd53496a79377.tmp
<Current directory>\$dpx$.tmp\67c49a74df240e4392ae229ba2d520db.tmp
<Current directory>\$dpx$.tmp\44e14856d624c54db6f572139a6683e9.tmp
<Current directory>\$dpx$.tmp\d57ce369bc064d46aa2502d2ec50ba34.tmp
<Current directory>\$dpx$.tmp\01d9031411aa1f49aecf2931afc12499.tmp
<Current directory>\$dpx$.tmp\5c5ae29398b81e4eb893623cae4b9bb0.tmp
<Current directory>\$dpx$.tmp\c0f67264c119934b8e9870f7f1957d5e.tmp
<Current directory>\$dpx$.tmp\8719d5ea9d461549b4c0c6dd93f70d49.tmp
<Current directory>\$dpx$.tmp\679ba3d7808af64db89614bef50eb459.tmp
<Current directory>\$dpx$.tmp\42e2da373bcf8c45aa30b61acbadeb5f.tmp
<Current directory>\$dpx$.tmp\00859e1f7707ec4ba864bc2e63f049df.tmp
<Current directory>\$dpx$.tmp\120fde4da6509a42884aeca76b9bc6a6.tmp
<Current directory>\$dpx$.tmp\dc5eb283e019174ea7a6fdba8a941b7e.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\fb1731842b3d51459223c2cad2a447de.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\984f23e3243bd6489ad3ceb7e177fc66.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cff5f4ff609ab0459ecac45825e3dc38.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7269c78347fae444a8f4bb12d33c42d7.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c3e2a021bd90a54c91b0ff3b133b327d.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1a6b6131446f5146b4c9f610e561a6cd.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6da4e015f538c34a89db685a01a04683.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\360d53f6f27fc34db17bd6229ca627d3.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7ecbbda5725f7e4a80267d72d232b81f.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a4317a241c18e542845a88a8ade598c5.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3b4ffc39c584bf46bd39737b8d1b8b90.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9fa1ac94c51cef468d6ff6e6cc315935.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\46b4fa7e91092c43a8606841030f4cfb.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f3b85d9656783b42a6433c3e07fbb538.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9ffe72bd48990c44876fa726368ae537.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b805697e05d94946abbee4616c138d2b.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c7fc798de503824e82d7a684991acb8f.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\3f9182135351124292768352972b3000.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\a9210739fc8afa47bd5aca2883cc809c.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cd89de67c5ecf541a5c5a988153a24ce.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6d5e7a3a38e4af4eae8728b52c51d777.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a8efdf48fabee7468cfa192876086d06.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\120fde4da6509a42884aeca76b9bc6a6.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\030c1322fddef6438da2feae8c9faf05.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ebb8ec9cc788ed46b44c1e0991bf93ab.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\836f5b52518bde43aa7e19622fa66a44.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1a86646f00831d4095eb718946037958.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\872e748d5828da4f904e6cb49fd32ad8.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\c2efdc71b0abe7428798e9a433f2d255.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5d130b74d4c5c343a4bcd53496a79377.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\67c49a74df240e4392ae229ba2d520db.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\811b784856275b4b98a1392fffd215c7.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\44e14856d624c54db6f572139a6683e9.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\01d9031411aa1f49aecf2931afc12499.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5c5ae29398b81e4eb893623cae4b9bb0.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c0f67264c119934b8e9870f7f1957d5e.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8719d5ea9d461549b4c0c6dd93f70d49.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\679ba3d7808af64db89614bef50eb459.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\42e2da373bcf8c45aa30b61acbadeb5f.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\00859e1f7707ec4ba864bc2e63f049df.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ae6e2ec39169574fbdca22198a8440ab.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d57ce369bc064d46aa2502d2ec50ba34.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\d242d9a65f8195479e18926a66e449c4.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\dc5eb283e019174ea7a6fdba8a941b7e.tmp to <Current directory>\vcruntime140.dll

Network activity

Connects to

'lp##.beahh.com':443
'lp##.haqo.net':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней