Trojan.DownLoader33.17011

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\a99c5c4da7f2ab4185276c7e27418ac6.tmp
<Current directory>\$dpx$.tmp\484169d1479193429c31243705ea3456.tmp
<Current directory>\$dpx$.tmp\da23bddb1419254da435e4c3ce4534f1.tmp
<Current directory>\$dpx$.tmp\6d0ae3098ced3b4f943a4e155988a815.tmp
<Current directory>\$dpx$.tmp\506e9c4ec3dff647a18673fa92c9af6d.tmp
<Current directory>\$dpx$.tmp\cf437e97d4689e479bda58f7f2ba9148.tmp
<Current directory>\$dpx$.tmp\60ee116118c86444a872e3a22e47b13f.tmp
<Current directory>\$dpx$.tmp\21566089a549874ca6d453b89628180a.tmp
<Current directory>\$dpx$.tmp\7b91260c44c9ff4b8250ddd2662b1302.tmp
<Current directory>\$dpx$.tmp\61e12a7867e96949899c277becddc637.tmp
<Current directory>\$dpx$.tmp\675b9a1e27c59d4ba9b677dcbe82cb69.tmp
<Current directory>\$dpx$.tmp\2bd2e0734f51844b95153a8e7f26833d.tmp
<Current directory>\$dpx$.tmp\a527dc0fb82e044c903b120305758323.tmp
<Current directory>\$dpx$.tmp\df50c3007c88744b94d54ca3ca97e08c.tmp
<Current directory>\$dpx$.tmp\34aa5bcfa5c8f14596a946c297c13c73.tmp
<Current directory>\$dpx$.tmp\4da113cc80ce5c40b16c4fe0ebc7d8a1.tmp
<Current directory>\$dpx$.tmp\e133aa3b0fa15d4e909d25156f0bd42c.tmp
<Current directory>\$dpx$.tmp\2f99887f9eb13b468dc2e8d51fb5c9c5.tmp
<Current directory>\$dpx$.tmp\1defc6ba352848488de2872f13fa25ba.tmp
<Current directory>\$dpx$.tmp\2ccc8cd9a44fc64eafd7c2814546c6d2.tmp
<Current directory>\$dpx$.tmp\832b849aa8fb5e408464abbbb7729a1f.tmp
<Current directory>\$dpx$.tmp\76ad2817a300634bad8f15f6d48c1206.tmp
<Current directory>\$dpx$.tmp\9d9f14adf7ad094f9b0b9c7819ba924c.tmp
<Current directory>\$dpx$.tmp\52de7d60a4b858489ddc297669c0c63a.tmp
<Current directory>\$dpx$.tmp\284863554e53ed41b68a95411d6b21d1.tmp
<Current directory>\$dpx$.tmp\e40c6a4e60c9cc458f8a352797a88e1e.tmp
<Current directory>\$dpx$.tmp\64faae04b68edb479ae959fb1af1503b.tmp
<Current directory>\$dpx$.tmp\2a89cbb677fc5748b65df09c40396546.tmp
<Current directory>\$dpx$.tmp\107a7d184cd5c648a4be026aada5c278.tmp
<Current directory>\$dpx$.tmp\a857e0abac93f244bafc162b277fae3b.tmp
<Current directory>\$dpx$.tmp\d9290afd1b48d7468696649c74d717e1.tmp
<Current directory>\$dpx$.tmp\134a1a7accffe54aba5fee8fa57bea16.tmp
<Current directory>\$dpx$.tmp\51a1e4409ba19b4dbcc41e8fb641b238.tmp
<Current directory>\$dpx$.tmp\3b0e7aa385bc094fb2c7337409381e2f.tmp
<Current directory>\$dpx$.tmp\bc8df43a3081214585b170f2c8a41b0d.tmp
<Current directory>\$dpx$.tmp\a50ea6be4818f14c8da63d95b9ccd896.tmp
<Current directory>\$dpx$.tmp\55978f6631018c4f8646613d88dccebe.tmp
<Current directory>\$dpx$.tmp\186abc9aca4df548a69c218c61feb1fc.tmp
<Current directory>\$dpx$.tmp\ffd52bbb6c5d784eb33ad047f52e915a.tmp
<Current directory>\$dpx$.tmp\36ffce670446e741a67037c3d73bc1b4.tmp
<Current directory>\$dpx$.tmp\c795e97295778c4492904876d4d994d6.tmp
<Current directory>\$dpx$.tmp\02c1c50346cb73478af65ffc71dd6dca.tmp
<Current directory>\$dpx$.tmp\7161031d5e27304d91628315279d346f.tmp
<Current directory>\$dpx$.tmp\ef845dc7d75d0a459db3ee6478b3e98e.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\52de7d60a4b858489ddc297669c0c63a.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\da23bddb1419254da435e4c3ce4534f1.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6d0ae3098ced3b4f943a4e155988a815.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\506e9c4ec3dff647a18673fa92c9af6d.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cf437e97d4689e479bda58f7f2ba9148.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\60ee116118c86444a872e3a22e47b13f.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\21566089a549874ca6d453b89628180a.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7b91260c44c9ff4b8250ddd2662b1302.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a99c5c4da7f2ab4185276c7e27418ac6.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\484169d1479193429c31243705ea3456.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\61e12a7867e96949899c277becddc637.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a527dc0fb82e044c903b120305758323.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\df50c3007c88744b94d54ca3ca97e08c.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\34aa5bcfa5c8f14596a946c297c13c73.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4da113cc80ce5c40b16c4fe0ebc7d8a1.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e133aa3b0fa15d4e909d25156f0bd42c.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2f99887f9eb13b468dc2e8d51fb5c9c5.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\1defc6ba352848488de2872f13fa25ba.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\675b9a1e27c59d4ba9b677dcbe82cb69.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2bd2e0734f51844b95153a8e7f26833d.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2ccc8cd9a44fc64eafd7c2814546c6d2.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\76ad2817a300634bad8f15f6d48c1206.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\7161031d5e27304d91628315279d346f.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e40c6a4e60c9cc458f8a352797a88e1e.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\64faae04b68edb479ae959fb1af1503b.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2a89cbb677fc5748b65df09c40396546.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\107a7d184cd5c648a4be026aada5c278.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\a857e0abac93f244bafc162b277fae3b.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\d9290afd1b48d7468696649c74d717e1.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\134a1a7accffe54aba5fee8fa57bea16.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\51a1e4409ba19b4dbcc41e8fb641b238.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\284863554e53ed41b68a95411d6b21d1.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3b0e7aa385bc094fb2c7337409381e2f.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a50ea6be4818f14c8da63d95b9ccd896.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\55978f6631018c4f8646613d88dccebe.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\186abc9aca4df548a69c218c61feb1fc.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ffd52bbb6c5d784eb33ad047f52e915a.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\36ffce670446e741a67037c3d73bc1b4.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\c795e97295778c4492904876d4d994d6.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\02c1c50346cb73478af65ffc71dd6dca.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9d9f14adf7ad094f9b0b9c7819ba924c.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bc8df43a3081214585b170f2c8a41b0d.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\832b849aa8fb5e408464abbbb7729a1f.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\ef845dc7d75d0a459db3ee6478b3e98e.tmp to <Current directory>\vcruntime140.dll

Network activity

Connects to

'lp##.haqo.net':443

TCP

'lp##.abbny.com':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней