Trojan.DownLoader33.15574

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\70ef27f8fc805649a14155a63e88c589.tmp
<Current directory>\$dpx$.tmp\e34bd0d5fca12b4cbc2d071472d80844.tmp
<Current directory>\$dpx$.tmp\5e6624bfdb9a4e48831eb340574a6e51.tmp
<Current directory>\$dpx$.tmp\ce552062d92fa5479173abe56aaf3a2f.tmp
<Current directory>\$dpx$.tmp\897d1d4eb814634ebfe552be2f062fe2.tmp
<Current directory>\$dpx$.tmp\2dec53f1f3a88b4c92f219ae42ac7ff5.tmp
<Current directory>\$dpx$.tmp\3b0f6aace85b044394c7608c8050cfd5.tmp
<Current directory>\$dpx$.tmp\221eb2b611f3b14ba8dc5ca2f50cb9d7.tmp
<Current directory>\$dpx$.tmp\fcfc59ad87ac034585f8299d54d401aa.tmp
<Current directory>\$dpx$.tmp\6d624b7d4c669e4481762de512937301.tmp
<Current directory>\$dpx$.tmp\7aa3e05678654d46b396df970affeaa8.tmp
<Current directory>\$dpx$.tmp\bae15a04de3ba2438f27cabd582d20ed.tmp
<Current directory>\$dpx$.tmp\1ba66be94b0ab24fae7338f97c23873f.tmp
<Current directory>\$dpx$.tmp\d06c3c519a2a814c93eae9e0821ff6d4.tmp
<Current directory>\$dpx$.tmp\5a805011a7328649809b6da9321d58de.tmp
<Current directory>\$dpx$.tmp\9fd6051f8a90144cbffe4e79ec14cf56.tmp
<Current directory>\$dpx$.tmp\c82d58cf056a654397f0b50e5442fa39.tmp
<Current directory>\$dpx$.tmp\8807242a1514314ea0dabbb5dbc63953.tmp
<Current directory>\$dpx$.tmp\fb7b1a824b56c74cbeb13b38bd3d7f6c.tmp
<Current directory>\$dpx$.tmp\3b02f98a29191c4295168765d789d28f.tmp
<Current directory>\$dpx$.tmp\bff98192a34d6741b20c35ac9d3b3317.tmp
<Current directory>\$dpx$.tmp\c723bc60e8c4a847be1308f25c9de9a7.tmp
<Current directory>\$dpx$.tmp\5959b3f567d8dc47a59cf6459841548b.tmp
<Current directory>\$dpx$.tmp\7a234d819c46e64880b632280839f376.tmp
<Current directory>\$dpx$.tmp\30bc23b274fcc04eb56293663553a1ee.tmp
<Current directory>\$dpx$.tmp\3b66c05a9f546d429075f4f62e424e1b.tmp
<Current directory>\$dpx$.tmp\a1c6805a8804a249bbcae71895bbf6e0.tmp
<Current directory>\$dpx$.tmp\80b1565df4aecf4386e6114294c34c36.tmp
<Current directory>\$dpx$.tmp\db37d48bc7a7644d9d799d843d16f1c0.tmp
<Current directory>\$dpx$.tmp\63a7e96323922e4ca05a44197b4fad62.tmp
<Current directory>\$dpx$.tmp\f57f87a758406b4cbe9b3c1902df8da7.tmp
<Current directory>\$dpx$.tmp\e8336157a3847942a9c3966a2551f64b.tmp
<Current directory>\$dpx$.tmp\51fba4dd2e8c5749946949f0e34486cf.tmp
<Current directory>\$dpx$.tmp\5c71307523da4a41a9b44b74aced6b58.tmp
<Current directory>\$dpx$.tmp\a7481d0d80d9b249a7e455cdd75acb22.tmp
<Current directory>\$dpx$.tmp\128362bfcf748543b51b3c2b9ce5900e.tmp
<Current directory>\$dpx$.tmp\21200e37664a1145ad3e0f3480b7a68f.tmp
<Current directory>\$dpx$.tmp\82b3ce95861e094ebba8e6ebca45e30a.tmp
<Current directory>\$dpx$.tmp\e5f2ad6adc62334e81613e873c8afd34.tmp
<Current directory>\$dpx$.tmp\4872e745f5614e4da4459390fffc9a2b.tmp
<Current directory>\$dpx$.tmp\f45f82fc35327f42b96b2a13cba6cb86.tmp
<Current directory>\$dpx$.tmp\28fbd6590b24464fbafc253e9d20e094.tmp
<Current directory>\$dpx$.tmp\bb3de62c363a37418f0cfb9646bcfa1b.tmp
<Current directory>\$dpx$.tmp\f7a2de788d4c6741aa42c3df4afab4a5.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\7a234d819c46e64880b632280839f376.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5e6624bfdb9a4e48831eb340574a6e51.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ce552062d92fa5479173abe56aaf3a2f.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\897d1d4eb814634ebfe552be2f062fe2.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2dec53f1f3a88b4c92f219ae42ac7ff5.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3b0f6aace85b044394c7608c8050cfd5.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\221eb2b611f3b14ba8dc5ca2f50cb9d7.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fcfc59ad87ac034585f8299d54d401aa.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\70ef27f8fc805649a14155a63e88c589.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e34bd0d5fca12b4cbc2d071472d80844.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6d624b7d4c669e4481762de512937301.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1ba66be94b0ab24fae7338f97c23873f.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d06c3c519a2a814c93eae9e0821ff6d4.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5a805011a7328649809b6da9321d58de.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9fd6051f8a90144cbffe4e79ec14cf56.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c82d58cf056a654397f0b50e5442fa39.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8807242a1514314ea0dabbb5dbc63953.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\fb7b1a824b56c74cbeb13b38bd3d7f6c.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\7aa3e05678654d46b396df970affeaa8.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bae15a04de3ba2438f27cabd582d20ed.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3b02f98a29191c4295168765d789d28f.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c723bc60e8c4a847be1308f25c9de9a7.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\bb3de62c363a37418f0cfb9646bcfa1b.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3b66c05a9f546d429075f4f62e424e1b.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a1c6805a8804a249bbcae71895bbf6e0.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\80b1565df4aecf4386e6114294c34c36.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\db37d48bc7a7644d9d799d843d16f1c0.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\63a7e96323922e4ca05a44197b4fad62.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\f57f87a758406b4cbe9b3c1902df8da7.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e8336157a3847942a9c3966a2551f64b.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\51fba4dd2e8c5749946949f0e34486cf.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\30bc23b274fcc04eb56293663553a1ee.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5c71307523da4a41a9b44b74aced6b58.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\128362bfcf748543b51b3c2b9ce5900e.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\21200e37664a1145ad3e0f3480b7a68f.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\82b3ce95861e094ebba8e6ebca45e30a.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e5f2ad6adc62334e81613e873c8afd34.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4872e745f5614e4da4459390fffc9a2b.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\f45f82fc35327f42b96b2a13cba6cb86.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\28fbd6590b24464fbafc253e9d20e094.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5959b3f567d8dc47a59cf6459841548b.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a7481d0d80d9b249a7e455cdd75acb22.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\bff98192a34d6741b20c35ac9d3b3317.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\f7a2de788d4c6741aa42c3df4afab4a5.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней