Trojan.DownLoader33.55323

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\eeab76d50fcfd14c9d3cbdf17b3d833d.tmp
<Current directory>\$dpx$.tmp\34b71415fe8b6f44abdde5aae815f47d.tmp
<Current directory>\$dpx$.tmp\1a50eba6521c2540bd80d33da5eea53e.tmp
<Current directory>\$dpx$.tmp\15e56d076c5e884ab68db77ef4f3a5a3.tmp
<Current directory>\$dpx$.tmp\7339505c80122c49912018df851f4706.tmp
<Current directory>\$dpx$.tmp\e0eb314dd162ec48b37f32904a7143da.tmp
<Current directory>\$dpx$.tmp\e9f9e1446c066741b9d5ab1f303429a0.tmp
<Current directory>\$dpx$.tmp\20a40f66a1558249950c85566b272ea3.tmp
<Current directory>\$dpx$.tmp\a72fd84eddfdfb42819c544329f338d7.tmp
<Current directory>\$dpx$.tmp\d6ad685f2565e04393c8f3678cd2b8cd.tmp
<Current directory>\$dpx$.tmp\9eb74b4f77cda2489b2f88c3605f0af0.tmp
<Current directory>\$dpx$.tmp\46740a59cf868e44835cd66ccf20ebbe.tmp
<Current directory>\$dpx$.tmp\0c6de01a6b982842a2491fb101269458.tmp
<Current directory>\$dpx$.tmp\4a2814be8895c141b9438c98aa946008.tmp
<Current directory>\$dpx$.tmp\ef45c9e45c941740bfd45918b508a987.tmp
<Current directory>\$dpx$.tmp\6dc293fcee5a1d4d84e9af5c49c7c59e.tmp
<Current directory>\$dpx$.tmp\19af0ae4d004254c969bdb6323f7bf9b.tmp
<Current directory>\$dpx$.tmp\6823a2d667e4be449e309cc64b3f9ca6.tmp
<Current directory>\$dpx$.tmp\14e1faceb1940c468daded8423767776.tmp
<Current directory>\$dpx$.tmp\4bc234f8f2fa1a40a10c6c17cb58240e.tmp
<Current directory>\$dpx$.tmp\8b08aa1e1898b64ba31a593f44355f35.tmp
<Current directory>\$dpx$.tmp\f22af6667593774b8665c0934975d4c9.tmp
<Current directory>\$dpx$.tmp\4892148710690e4a8a459f026f979378.tmp
<Current directory>\$dpx$.tmp\cf09d15f57629f479588c2d79c8f3081.tmp
<Current directory>\$dpx$.tmp\6cb743e1ba2f9645885e64b9e6a5f8de.tmp
<Current directory>\$dpx$.tmp\889d64ecbd592a4d81cef84101d43542.tmp
<Current directory>\$dpx$.tmp\b597d1ed5db7d7459f93ebdd00fe1117.tmp
<Current directory>\$dpx$.tmp\b11930a3e0949e4b9fae860b7516747f.tmp
<Current directory>\$dpx$.tmp\9f081b164f0a2f4e88f5c746ccf39e00.tmp
<Current directory>\$dpx$.tmp\20a00a4f8b31ab4f913c0e9677067170.tmp
<Current directory>\$dpx$.tmp\f2d6138b8b203e4096a1e5e5ff4a8636.tmp
<Current directory>\$dpx$.tmp\7b8cd8eaa8d0144d8d81c371ded48b50.tmp
<Current directory>\$dpx$.tmp\ebff5073c19d1a46a1f57386e113ed20.tmp
<Current directory>\$dpx$.tmp\2a7ff3586781ce4f982ee0bf4a83d6c2.tmp
<Current directory>\$dpx$.tmp\165ea8e1a51f1b4da10f8de1aef19a16.tmp
<Current directory>\$dpx$.tmp\61a75f1b4e69764591caa1d950aee12c.tmp
<Current directory>\$dpx$.tmp\48a6365d3d9c084dae9a5cf523886c1b.tmp
<Current directory>\$dpx$.tmp\0c27a1eb45a1ef42910c3294de947afa.tmp
<Current directory>\$dpx$.tmp\bb0c871801d84643a13b700026841c85.tmp
<Current directory>\$dpx$.tmp\e31b195a77f2b14ba05dd1e739dfbb7c.tmp
<Current directory>\$dpx$.tmp\304a10337c8bb2479282855f8886cf3b.tmp
<Current directory>\$dpx$.tmp\72de5a26eb672846a0c7c6363791eeba.tmp
<Current directory>\$dpx$.tmp\9bb4ef24bd06b04d9a3bff2aa28c4c76.tmp
<Current directory>\$dpx$.tmp\74c58b6c59acb34fac223ccf0fac7157.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\cf09d15f57629f479588c2d79c8f3081.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1a50eba6521c2540bd80d33da5eea53e.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\15e56d076c5e884ab68db77ef4f3a5a3.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7339505c80122c49912018df851f4706.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e0eb314dd162ec48b37f32904a7143da.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e9f9e1446c066741b9d5ab1f303429a0.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\20a40f66a1558249950c85566b272ea3.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a72fd84eddfdfb42819c544329f338d7.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\eeab76d50fcfd14c9d3cbdf17b3d833d.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\34b71415fe8b6f44abdde5aae815f47d.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d6ad685f2565e04393c8f3678cd2b8cd.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0c6de01a6b982842a2491fb101269458.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4a2814be8895c141b9438c98aa946008.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ef45c9e45c941740bfd45918b508a987.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6dc293fcee5a1d4d84e9af5c49c7c59e.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\19af0ae4d004254c969bdb6323f7bf9b.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6823a2d667e4be449e309cc64b3f9ca6.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\14e1faceb1940c468daded8423767776.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\9eb74b4f77cda2489b2f88c3605f0af0.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\46740a59cf868e44835cd66ccf20ebbe.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4bc234f8f2fa1a40a10c6c17cb58240e.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f22af6667593774b8665c0934975d4c9.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\9bb4ef24bd06b04d9a3bff2aa28c4c76.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\889d64ecbd592a4d81cef84101d43542.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b597d1ed5db7d7459f93ebdd00fe1117.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b11930a3e0949e4b9fae860b7516747f.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9f081b164f0a2f4e88f5c746ccf39e00.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\20a00a4f8b31ab4f913c0e9677067170.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\f2d6138b8b203e4096a1e5e5ff4a8636.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7b8cd8eaa8d0144d8d81c371ded48b50.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ebff5073c19d1a46a1f57386e113ed20.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6cb743e1ba2f9645885e64b9e6a5f8de.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2a7ff3586781ce4f982ee0bf4a83d6c2.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\61a75f1b4e69764591caa1d950aee12c.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\48a6365d3d9c084dae9a5cf523886c1b.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0c27a1eb45a1ef42910c3294de947afa.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bb0c871801d84643a13b700026841c85.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e31b195a77f2b14ba05dd1e739dfbb7c.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\304a10337c8bb2479282855f8886cf3b.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\72de5a26eb672846a0c7c6363791eeba.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4892148710690e4a8a459f026f979378.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\165ea8e1a51f1b4da10f8de1aef19a16.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\8b08aa1e1898b64ba31a593f44355f35.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\74c58b6c59acb34fac223ccf0fac7157.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней