Trojan.DownLoader35.21836

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\58825009f8150a49b720bf80431c79b7.tmp
<Current directory>\$dpx$.tmp\5c63fe94ccaf614ea2549fb72dcffeda.tmp
<Current directory>\$dpx$.tmp\7a4a1ab5c83fbf4bbc28bb139fb41a9f.tmp
<Current directory>\$dpx$.tmp\055d8a2eb76de6469a27affc9e26808b.tmp
<Current directory>\$dpx$.tmp\d628562d2d4135479ade39c35dc7ebca.tmp
<Current directory>\$dpx$.tmp\8a195703c3265f4f8569574ffb1a25c4.tmp
<Current directory>\$dpx$.tmp\660996b00b892b4192aa4703f0d23030.tmp
<Current directory>\$dpx$.tmp\3502509111be004b886d47b584329a2d.tmp
<Current directory>\$dpx$.tmp\c79068dfdc524d40818452b2e095d5e8.tmp
<Current directory>\$dpx$.tmp\a0e65b399f7c23488d66ab4277998ae8.tmp
<Current directory>\$dpx$.tmp\85e7fb98bc3ee04090e2b88cf8157aac.tmp
<Current directory>\$dpx$.tmp\f1d59d190a2c4a488d973c877c30f734.tmp
<Current directory>\$dpx$.tmp\201d5fd66b3fc348a7ca4da9465e616f.tmp
<Current directory>\$dpx$.tmp\99530f15da7037488caabc14cd9eade7.tmp
<Current directory>\$dpx$.tmp\0ecb06ca14e418419a6149abe5cd1f09.tmp
<Current directory>\$dpx$.tmp\30b9ebb77f092e4f891ac9716a8262d7.tmp
<Current directory>\$dpx$.tmp\a986770ef545fa498ade588454b37c57.tmp
<Current directory>\$dpx$.tmp\41bb80e82a434544a9a90d3be3fdf09a.tmp
<Current directory>\$dpx$.tmp\1dc79fd67669b14d85014a63d5dcb423.tmp
<Current directory>\$dpx$.tmp\7da7d51746eb6e4990d655b688385564.tmp
<Current directory>\$dpx$.tmp\342f15e6f3a336428907300f34bdc87b.tmp
<Current directory>\$dpx$.tmp\126b6dd99e7b2a4d8bf4517c1c26b962.tmp
<Current directory>\$dpx$.tmp\7cdbb07af03e4349a43cb4ed4ba2c208.tmp
<Current directory>\$dpx$.tmp\5a85628d5825cb4598417e418cbe59cb.tmp
<Current directory>\$dpx$.tmp\1a76a907347652489cd5a2b929f0335c.tmp
<Current directory>\$dpx$.tmp\4c5866722a5ce74f97540b0081475408.tmp
<Current directory>\$dpx$.tmp\6fbde7a17989054990155b91b4d7d289.tmp
<Current directory>\$dpx$.tmp\e001d1219720ac4f8a0aa75b9dce08e6.tmp
<Current directory>\$dpx$.tmp\6e8f07396d6b774eb7d18b9610c20778.tmp
<Current directory>\$dpx$.tmp\fd536629dd144b46a58fb0883cde52b8.tmp
<Current directory>\$dpx$.tmp\3b612d0784240f44a2a71e13e6d9410c.tmp
<Current directory>\$dpx$.tmp\edab880c37cc5b429366e79d99926e30.tmp
<Current directory>\$dpx$.tmp\908cb4397d62894f9e3a2572aa313790.tmp
<Current directory>\$dpx$.tmp\830c5ccdaab01341a53e664ba530bc08.tmp
<Current directory>\$dpx$.tmp\11f9bb5320362843be74c296f411fdb0.tmp
<Current directory>\$dpx$.tmp\ce42cafbdc79974182dbf39b34059465.tmp
<Current directory>\$dpx$.tmp\e4d3aa1ec9d9f7469472b651d670ab74.tmp
<Current directory>\$dpx$.tmp\94c370b011a1d942913a2f93f416ac91.tmp
<Current directory>\$dpx$.tmp\49e746888cda13478f14134e3a258c17.tmp
<Current directory>\$dpx$.tmp\39408e0758cf854d9f1ea94f8e626149.tmp
<Current directory>\$dpx$.tmp\1d66dee6359e4e4d9e52c576db975b19.tmp
<Current directory>\$dpx$.tmp\4894bc8d2e72a246b73aabe07e588d1b.tmp
<Current directory>\$dpx$.tmp\69e7e954860614489624c27c0382726c.tmp
<Current directory>\$dpx$.tmp\c80a3654ad6a29408bef35dd75d51119.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\5a85628d5825cb4598417e418cbe59cb.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7a4a1ab5c83fbf4bbc28bb139fb41a9f.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\055d8a2eb76de6469a27affc9e26808b.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d628562d2d4135479ade39c35dc7ebca.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8a195703c3265f4f8569574ffb1a25c4.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\660996b00b892b4192aa4703f0d23030.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3502509111be004b886d47b584329a2d.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c79068dfdc524d40818452b2e095d5e8.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\58825009f8150a49b720bf80431c79b7.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5c63fe94ccaf614ea2549fb72dcffeda.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a0e65b399f7c23488d66ab4277998ae8.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\201d5fd66b3fc348a7ca4da9465e616f.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\99530f15da7037488caabc14cd9eade7.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0ecb06ca14e418419a6149abe5cd1f09.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\30b9ebb77f092e4f891ac9716a8262d7.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a986770ef545fa498ade588454b37c57.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\41bb80e82a434544a9a90d3be3fdf09a.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\1dc79fd67669b14d85014a63d5dcb423.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\85e7fb98bc3ee04090e2b88cf8157aac.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f1d59d190a2c4a488d973c877c30f734.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7da7d51746eb6e4990d655b688385564.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\126b6dd99e7b2a4d8bf4517c1c26b962.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\69e7e954860614489624c27c0382726c.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4c5866722a5ce74f97540b0081475408.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6fbde7a17989054990155b91b4d7d289.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e001d1219720ac4f8a0aa75b9dce08e6.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6e8f07396d6b774eb7d18b9610c20778.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\fd536629dd144b46a58fb0883cde52b8.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\3b612d0784240f44a2a71e13e6d9410c.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\edab880c37cc5b429366e79d99926e30.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\908cb4397d62894f9e3a2572aa313790.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1a76a907347652489cd5a2b929f0335c.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\830c5ccdaab01341a53e664ba530bc08.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ce42cafbdc79974182dbf39b34059465.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e4d3aa1ec9d9f7469472b651d670ab74.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\94c370b011a1d942913a2f93f416ac91.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\49e746888cda13478f14134e3a258c17.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\39408e0758cf854d9f1ea94f8e626149.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\1d66dee6359e4e4d9e52c576db975b19.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4894bc8d2e72a246b73aabe07e588d1b.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7cdbb07af03e4349a43cb4ed4ba2c208.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\11f9bb5320362843be74c296f411fdb0.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\342f15e6f3a336428907300f34bdc87b.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\c80a3654ad6a29408bef35dd75d51119.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней