Trojan.DownLoader33.17994

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\42daeeab02f4b948b0e1db4b64d57c1e.tmp
<Current directory>\$dpx$.tmp\dc7ce579773a974f8f975239b3d0b0c2.tmp
<Current directory>\$dpx$.tmp\9c87611dc2c3714394b676837397dff8.tmp
<Current directory>\$dpx$.tmp\844fc4e606cb6b4788231ec6aa8e633b.tmp
<Current directory>\$dpx$.tmp\f02432adf33b6f4594e30e882806e3ba.tmp
<Current directory>\$dpx$.tmp\17ae64d6ef62eb4597b78cf62691ee49.tmp
<Current directory>\$dpx$.tmp\7f2e84409562834a93ade1528cb090ec.tmp
<Current directory>\$dpx$.tmp\8901e6b0fe65f747816d9445f432e183.tmp
<Current directory>\$dpx$.tmp\20784152df744e47b120a8fe4cb768d7.tmp
<Current directory>\$dpx$.tmp\126a56f83161fc48b61a3a61d7851f70.tmp
<Current directory>\$dpx$.tmp\eefa6a93e416f5488096762fde2a1f00.tmp
<Current directory>\$dpx$.tmp\70292b1e873cc048b5ff57494e8f4635.tmp
<Current directory>\$dpx$.tmp\5d8fec25cfb5ed4caecc3c258649085b.tmp
<Current directory>\$dpx$.tmp\c64d94f2a7c513469515664ed3e6fe64.tmp
<Current directory>\$dpx$.tmp\9a6faa144c091d4f8e869fcdfd6ffcf1.tmp
<Current directory>\$dpx$.tmp\b13e0a0fa14b5546b2b49ea5b64a86d0.tmp
<Current directory>\$dpx$.tmp\e1db1b5fc0e99b4eb4bcac45f818e3f3.tmp
<Current directory>\$dpx$.tmp\1f8a1c2da6eec94b96984690ab54d621.tmp
<Current directory>\$dpx$.tmp\be387cf8e6f4b045a152246836e943e7.tmp
<Current directory>\$dpx$.tmp\9f6f54d4d0a29f44878c7da1da70b4f8.tmp
<Current directory>\$dpx$.tmp\332162e19c57674e89a5f8c1bf889081.tmp
<Current directory>\$dpx$.tmp\f8095369fc131d42bc7a7540250a5cb7.tmp
<Current directory>\$dpx$.tmp\c5d064d37d033348861ad3bcc423e0c9.tmp
<Current directory>\$dpx$.tmp\075bd8dd3d71fd47a7b96f83e138a2b7.tmp
<Current directory>\$dpx$.tmp\4a4e5b0dee429541aaacc2e0aea6138a.tmp
<Current directory>\$dpx$.tmp\f1959edd63a5a14c8cee4b46c993d0fc.tmp
<Current directory>\$dpx$.tmp\e8cb0736d0926d4095aa5ac2ed450cc7.tmp
<Current directory>\$dpx$.tmp\a2ac857f1ff6f344934715a66a643b41.tmp
<Current directory>\$dpx$.tmp\8a97bad122787645905fdafe5b77d461.tmp
<Current directory>\$dpx$.tmp\869afee7c5c3244db1f9e9ce2e65f3dd.tmp
<Current directory>\$dpx$.tmp\7ff8ceafe05b7d42842eba9466af5ca6.tmp
<Current directory>\$dpx$.tmp\872ac101b9cd1e49b97e41e9dbe0ed3a.tmp
<Current directory>\$dpx$.tmp\fa917527269da647bcc3a8b62512aa55.tmp
<Current directory>\$dpx$.tmp\8817fe8fb264da4783dbc2995ad1158d.tmp
<Current directory>\$dpx$.tmp\a4f961b12274dd479c3f2f3c0ec3f9e3.tmp
<Current directory>\$dpx$.tmp\11853fa88965cd4b80c2fe8d7607dff0.tmp
<Current directory>\$dpx$.tmp\88804e285058eb41b046ac3229c9d904.tmp
<Current directory>\$dpx$.tmp\a3f806f5e840c3489e87a146370be625.tmp
<Current directory>\$dpx$.tmp\497a280f7103a248882ee3bce665bc74.tmp
<Current directory>\$dpx$.tmp\af8c4be044ab81468fc821db142943cc.tmp
<Current directory>\$dpx$.tmp\186837b876bded4eb25f931e39a9c68b.tmp
<Current directory>\$dpx$.tmp\9f57533b68a96447ada4111dbadf121b.tmp
<Current directory>\$dpx$.tmp\485adddf33704048a30e3f7347df63a3.tmp
<Current directory>\$dpx$.tmp\177ee4d6acd12e4f8658efc785fed48b.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\075bd8dd3d71fd47a7b96f83e138a2b7.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9c87611dc2c3714394b676837397dff8.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\844fc4e606cb6b4788231ec6aa8e633b.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f02432adf33b6f4594e30e882806e3ba.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\17ae64d6ef62eb4597b78cf62691ee49.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7f2e84409562834a93ade1528cb090ec.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8901e6b0fe65f747816d9445f432e183.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\20784152df744e47b120a8fe4cb768d7.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\42daeeab02f4b948b0e1db4b64d57c1e.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\dc7ce579773a974f8f975239b3d0b0c2.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\126a56f83161fc48b61a3a61d7851f70.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5d8fec25cfb5ed4caecc3c258649085b.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c64d94f2a7c513469515664ed3e6fe64.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9a6faa144c091d4f8e869fcdfd6ffcf1.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b13e0a0fa14b5546b2b49ea5b64a86d0.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e1db1b5fc0e99b4eb4bcac45f818e3f3.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1f8a1c2da6eec94b96984690ab54d621.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\be387cf8e6f4b045a152246836e943e7.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\eefa6a93e416f5488096762fde2a1f00.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\70292b1e873cc048b5ff57494e8f4635.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9f6f54d4d0a29f44878c7da1da70b4f8.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f8095369fc131d42bc7a7540250a5cb7.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\485adddf33704048a30e3f7347df63a3.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f1959edd63a5a14c8cee4b46c993d0fc.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e8cb0736d0926d4095aa5ac2ed450cc7.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a2ac857f1ff6f344934715a66a643b41.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8a97bad122787645905fdafe5b77d461.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\869afee7c5c3244db1f9e9ce2e65f3dd.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\7ff8ceafe05b7d42842eba9466af5ca6.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\872ac101b9cd1e49b97e41e9dbe0ed3a.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fa917527269da647bcc3a8b62512aa55.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4a4e5b0dee429541aaacc2e0aea6138a.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8817fe8fb264da4783dbc2995ad1158d.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\11853fa88965cd4b80c2fe8d7607dff0.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\88804e285058eb41b046ac3229c9d904.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a3f806f5e840c3489e87a146370be625.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\497a280f7103a248882ee3bce665bc74.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\af8c4be044ab81468fc821db142943cc.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\186837b876bded4eb25f931e39a9c68b.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9f57533b68a96447ada4111dbadf121b.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c5d064d37d033348861ad3bcc423e0c9.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a4f961b12274dd479c3f2f3c0ec3f9e3.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\332162e19c57674e89a5f8c1bf889081.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\177ee4d6acd12e4f8658efc785fed48b.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней