Trojan.DownLoader33.15620

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\2252937cee8c1a4881bfb5f4b9120e16.tmp
<Current directory>\$dpx$.tmp\94e2de0d1eae6e4cb63608ae81cc96b3.tmp
<Current directory>\$dpx$.tmp\cef89f692e0aaa44b795f673837c5448.tmp
<Current directory>\$dpx$.tmp\639d957bd5bda8478fb8d8222b70d78c.tmp
<Current directory>\$dpx$.tmp\e6d8b764e6b7e74ea2e1a111578c8996.tmp
<Current directory>\$dpx$.tmp\1c7350090cb8024384de40515325938a.tmp
<Current directory>\$dpx$.tmp\490186e0179eec45b9bcf46371b98b0e.tmp
<Current directory>\$dpx$.tmp\8dbecea47cff304a9d9d0a0eb2b5324d.tmp
<Current directory>\$dpx$.tmp\c06a8781debb7942a94d3ef0701da9f6.tmp
<Current directory>\$dpx$.tmp\c8f6b24a46871144aaf609b77478ce21.tmp
<Current directory>\$dpx$.tmp\09329068a7aa434e927efd3f6d8cf94d.tmp
<Current directory>\$dpx$.tmp\e9257578b1545a46a18ea852cc2690c1.tmp
<Current directory>\$dpx$.tmp\71ac9a6b61353342ac0571a49a9e10eb.tmp
<Current directory>\$dpx$.tmp\e4127b421ed900408fb3667f1b6a2068.tmp
<Current directory>\$dpx$.tmp\a4cce5eb273f3440b0f53fa1b85379c0.tmp
<Current directory>\$dpx$.tmp\8729b3f140e71e49a0f391277048e7fc.tmp
<Current directory>\$dpx$.tmp\4de42ca12eec7a4abefa69c82b44d0f2.tmp
<Current directory>\$dpx$.tmp\4bf3de297b3cf2498b4a3bddc66b78c9.tmp
<Current directory>\$dpx$.tmp\7d2065237fd3ca449642fce4c395e07a.tmp
<Current directory>\$dpx$.tmp\5c4bf96f9871aa4e971bb3ae8a6434e7.tmp
<Current directory>\$dpx$.tmp\45054478c48a044fa357d444992b402d.tmp
<Current directory>\$dpx$.tmp\462ef48bcc27d245973fd5d3db105ab1.tmp
<Current directory>\$dpx$.tmp\3eac1b570d1d2a438f635ea7fc0e9629.tmp
<Current directory>\$dpx$.tmp\dca529286b87d64f99d18586462bb017.tmp
<Current directory>\$dpx$.tmp\1b408c8055e3f044b417f854cbcb754d.tmp
<Current directory>\$dpx$.tmp\d3fc07f573519348900a34b0142b9e6f.tmp
<Current directory>\$dpx$.tmp\3b49827debf89d4680350dbf5bf53eb2.tmp
<Current directory>\$dpx$.tmp\db7f053e41725f4db0a3169c7b1fc277.tmp
<Current directory>\$dpx$.tmp\79e93bcb22918149a9a210c366a27f23.tmp
<Current directory>\$dpx$.tmp\fe16609b9afc49469e1e2a7a2b1d0943.tmp
<Current directory>\$dpx$.tmp\7bbc49a7bfccbc46a520de94c44c785a.tmp
<Current directory>\$dpx$.tmp\afe9fcf949ca9148a58d7736a19a82ef.tmp
<Current directory>\$dpx$.tmp\3a8ea1cc255ce840916d30c8da4b8463.tmp
<Current directory>\$dpx$.tmp\2cb5795cd304964eb69331d5bbee85ca.tmp
<Current directory>\$dpx$.tmp\66ab4a3016d76b419c2a3bda46bbfe70.tmp
<Current directory>\$dpx$.tmp\7806ce8248246140ab3468e1eedf498b.tmp
<Current directory>\$dpx$.tmp\84d9163d188fd34787af279743fd4f62.tmp
<Current directory>\$dpx$.tmp\b08435cc18805e42bd039bb55a3897ae.tmp
<Current directory>\$dpx$.tmp\bea2c29c68a1b04fbeae2079f85ef346.tmp
<Current directory>\$dpx$.tmp\11146051f36926438e192e6eccffdd23.tmp
<Current directory>\$dpx$.tmp\171b51f9b5594b4b91a27fa05436c659.tmp
<Current directory>\$dpx$.tmp\be0ef906de83584292bbac2d88ea5b94.tmp
<Current directory>\$dpx$.tmp\acd5bec12118af48a4dcbb334239fc86.tmp
<Current directory>\$dpx$.tmp\c6ed7d45c5e10b418940bdf1846a6748.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\dca529286b87d64f99d18586462bb017.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cef89f692e0aaa44b795f673837c5448.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\639d957bd5bda8478fb8d8222b70d78c.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e6d8b764e6b7e74ea2e1a111578c8996.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1c7350090cb8024384de40515325938a.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\490186e0179eec45b9bcf46371b98b0e.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8dbecea47cff304a9d9d0a0eb2b5324d.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c06a8781debb7942a94d3ef0701da9f6.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2252937cee8c1a4881bfb5f4b9120e16.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\94e2de0d1eae6e4cb63608ae81cc96b3.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c8f6b24a46871144aaf609b77478ce21.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\71ac9a6b61353342ac0571a49a9e10eb.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e4127b421ed900408fb3667f1b6a2068.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a4cce5eb273f3440b0f53fa1b85379c0.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8729b3f140e71e49a0f391277048e7fc.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4de42ca12eec7a4abefa69c82b44d0f2.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4bf3de297b3cf2498b4a3bddc66b78c9.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\7d2065237fd3ca449642fce4c395e07a.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\09329068a7aa434e927efd3f6d8cf94d.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e9257578b1545a46a18ea852cc2690c1.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5c4bf96f9871aa4e971bb3ae8a6434e7.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\462ef48bcc27d245973fd5d3db105ab1.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\acd5bec12118af48a4dcbb334239fc86.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d3fc07f573519348900a34b0142b9e6f.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3b49827debf89d4680350dbf5bf53eb2.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\db7f053e41725f4db0a3169c7b1fc277.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\79e93bcb22918149a9a210c366a27f23.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\fe16609b9afc49469e1e2a7a2b1d0943.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\7bbc49a7bfccbc46a520de94c44c785a.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\afe9fcf949ca9148a58d7736a19a82ef.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3a8ea1cc255ce840916d30c8da4b8463.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1b408c8055e3f044b417f854cbcb754d.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2cb5795cd304964eb69331d5bbee85ca.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7806ce8248246140ab3468e1eedf498b.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\84d9163d188fd34787af279743fd4f62.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b08435cc18805e42bd039bb55a3897ae.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bea2c29c68a1b04fbeae2079f85ef346.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\11146051f36926438e192e6eccffdd23.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\171b51f9b5594b4b91a27fa05436c659.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\be0ef906de83584292bbac2d88ea5b94.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3eac1b570d1d2a438f635ea7fc0e9629.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\66ab4a3016d76b419c2a3bda46bbfe70.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\45054478c48a044fa357d444992b402d.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\c6ed7d45c5e10b418940bdf1846a6748.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней