Trojan.DownLoader33.15610

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\0953240ac10a5c489e905f5a2e7c1342.tmp
<Current directory>\$dpx$.tmp\799ec29289a4df47ad06907d54a84d46.tmp
<Current directory>\$dpx$.tmp\7ae7e37ce2b2d54f82234066a1304862.tmp
<Current directory>\$dpx$.tmp\c7c9cef731cf7046af06d73924a0c282.tmp
<Current directory>\$dpx$.tmp\334b44495838bd48ac0631dbfe042f13.tmp
<Current directory>\$dpx$.tmp\abbaf0b6be38c14c96954557f08af298.tmp
<Current directory>\$dpx$.tmp\99d1d1b796de294bb34d64d460d1aa2f.tmp
<Current directory>\$dpx$.tmp\09f9c67a92f1aa40b18107b32431b6ae.tmp
<Current directory>\$dpx$.tmp\1f1e94e8437c054488cffb2f23fdef69.tmp
<Current directory>\$dpx$.tmp\e07e508a38b0b24992f85812d9820e32.tmp
<Current directory>\$dpx$.tmp\e94ab8bbf5ff1948b3e1f4a982a9ab36.tmp
<Current directory>\$dpx$.tmp\2cf33830676e60409b5f16f97682b77b.tmp
<Current directory>\$dpx$.tmp\09ecdb39862bda47892f759f93eb5908.tmp
<Current directory>\$dpx$.tmp\e99f291ac7cbf041b519856835c1b857.tmp
<Current directory>\$dpx$.tmp\acf6ec8b6fabb7489d3426ffd9015c64.tmp
<Current directory>\$dpx$.tmp\3f459686588bb448bb5d0aae0eced2a0.tmp
<Current directory>\$dpx$.tmp\58a3d88cf7bfb34ea0e85ad955fab849.tmp
<Current directory>\$dpx$.tmp\bfed6248538e284482593e55ff7417e1.tmp
<Current directory>\$dpx$.tmp\0f8906e6827aca4a86bcb77a47b7c871.tmp
<Current directory>\$dpx$.tmp\68ac26f79698e14d957d90a1832fcd33.tmp
<Current directory>\$dpx$.tmp\baecbaf8fdcf6945b0cede22921c5b46.tmp
<Current directory>\$dpx$.tmp\3c57e0d245f8d6468f0a2f6079a8c320.tmp
<Current directory>\$dpx$.tmp\168e7bfd9cde8548a70ce77bf6b7adb1.tmp
<Current directory>\$dpx$.tmp\9d68335f03563d4fa5826b27494409f6.tmp
<Current directory>\$dpx$.tmp\409968b53b38624f9ae2f2198b200161.tmp
<Current directory>\$dpx$.tmp\3e5ef2543ee49a40b7752617a651cbb8.tmp
<Current directory>\$dpx$.tmp\dd7b3f4df3116b418d3f85f9990e9694.tmp
<Current directory>\$dpx$.tmp\287fd8e723ff4a438d7e83ef15b223f0.tmp
<Current directory>\$dpx$.tmp\f7b808a8b7d45f468835bec72541b722.tmp
<Current directory>\$dpx$.tmp\d4b00ee4f89e614ea9276f377d9c62f2.tmp
<Current directory>\$dpx$.tmp\e5f3d7a7c4cbb840ab5356f1d84439ee.tmp
<Current directory>\$dpx$.tmp\c5423fe4be45a348acf691565a371a79.tmp
<Current directory>\$dpx$.tmp\acc1b9a806651c459d674bbca6f9296b.tmp
<Current directory>\$dpx$.tmp\f5c086650151d94780e8008c7812e61c.tmp
<Current directory>\$dpx$.tmp\7aedaed5315ec54bb51587343bfa67c8.tmp
<Current directory>\$dpx$.tmp\8ef9f669ba529e459ae3cd46070ba22b.tmp
<Current directory>\$dpx$.tmp\7fb22168b2b2974187e06d266d08da71.tmp
<Current directory>\$dpx$.tmp\e3ed23e1bb616345a84cbd2da3cc001c.tmp
<Current directory>\$dpx$.tmp\785789217cac4b47a94f511e41d308f6.tmp
<Current directory>\$dpx$.tmp\9391c71b12f11a439cbe75460a109eb0.tmp
<Current directory>\$dpx$.tmp\3c91dec267c4b0408c31c143f249b459.tmp
<Current directory>\$dpx$.tmp\43e5dc37b20d3e4e901bd3fcf1fe237f.tmp
<Current directory>\$dpx$.tmp\c888d539b0f7b04fb63c7e3924059dfa.tmp
<Current directory>\$dpx$.tmp\e7e971e434bae44f8fa8725dda221c10.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\9d68335f03563d4fa5826b27494409f6.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7ae7e37ce2b2d54f82234066a1304862.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c7c9cef731cf7046af06d73924a0c282.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\334b44495838bd48ac0631dbfe042f13.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\abbaf0b6be38c14c96954557f08af298.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\99d1d1b796de294bb34d64d460d1aa2f.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\09f9c67a92f1aa40b18107b32431b6ae.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1f1e94e8437c054488cffb2f23fdef69.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0953240ac10a5c489e905f5a2e7c1342.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\799ec29289a4df47ad06907d54a84d46.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e07e508a38b0b24992f85812d9820e32.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\09ecdb39862bda47892f759f93eb5908.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e99f291ac7cbf041b519856835c1b857.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\acf6ec8b6fabb7489d3426ffd9015c64.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3f459686588bb448bb5d0aae0eced2a0.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\58a3d88cf7bfb34ea0e85ad955fab849.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bfed6248538e284482593e55ff7417e1.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\0f8906e6827aca4a86bcb77a47b7c871.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\e94ab8bbf5ff1948b3e1f4a982a9ab36.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2cf33830676e60409b5f16f97682b77b.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\68ac26f79698e14d957d90a1832fcd33.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3c57e0d245f8d6468f0a2f6079a8c320.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\c888d539b0f7b04fb63c7e3924059dfa.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3e5ef2543ee49a40b7752617a651cbb8.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\dd7b3f4df3116b418d3f85f9990e9694.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\287fd8e723ff4a438d7e83ef15b223f0.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f7b808a8b7d45f468835bec72541b722.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\d4b00ee4f89e614ea9276f377d9c62f2.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\e5f3d7a7c4cbb840ab5356f1d84439ee.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c5423fe4be45a348acf691565a371a79.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\acc1b9a806651c459d674bbca6f9296b.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\409968b53b38624f9ae2f2198b200161.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f5c086650151d94780e8008c7812e61c.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8ef9f669ba529e459ae3cd46070ba22b.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7fb22168b2b2974187e06d266d08da71.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e3ed23e1bb616345a84cbd2da3cc001c.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\785789217cac4b47a94f511e41d308f6.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9391c71b12f11a439cbe75460a109eb0.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\3c91dec267c4b0408c31c143f249b459.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\43e5dc37b20d3e4e901bd3fcf1fe237f.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\168e7bfd9cde8548a70ce77bf6b7adb1.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7aedaed5315ec54bb51587343bfa67c8.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\baecbaf8fdcf6945b0cede22921c5b46.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\e7e971e434bae44f8fa8725dda221c10.tmp to <Current directory>\vcruntime140.dll

Network activity

Connects to

'lp##.haqo.net':443

TCP

'lp##.abbny.com':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней