Trojan.DownLoader33.15611

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\2c13d9667006a0488f81524faf0293aa.tmp
<Current directory>\$dpx$.tmp\22cf107a0dac8249a7a9a6e9fc6ff94f.tmp
<Current directory>\$dpx$.tmp\f51a3fd12a13e94499face1f50839fa7.tmp
<Current directory>\$dpx$.tmp\2c44169388298d4390f0135cd81bea0f.tmp
<Current directory>\$dpx$.tmp\f8e0e5a1936b8648919e2930d012f42d.tmp
<Current directory>\$dpx$.tmp\0794a897f280e842b1d46d1706c01d14.tmp
<Current directory>\$dpx$.tmp\2c184abd203c96478ea5150dc85787cd.tmp
<Current directory>\$dpx$.tmp\29723e1393d5104680e265c334361ab1.tmp
<Current directory>\$dpx$.tmp\21c4322c5a5c2045ad865d64bff13aff.tmp
<Current directory>\$dpx$.tmp\98dccd60f1820d40beaf0b2a5fc7ae01.tmp
<Current directory>\$dpx$.tmp\c6e43e832b2b6f48ae812b488c9c29ef.tmp
<Current directory>\$dpx$.tmp\fec4c87b1f1dcd4995267b6b57f360a4.tmp
<Current directory>\$dpx$.tmp\a584594fd0dd57498d738a2742a2fdd7.tmp
<Current directory>\$dpx$.tmp\aa54af015afb774891032da459fdf940.tmp
<Current directory>\$dpx$.tmp\cf10e97f65adce44b3598b51b76b02ed.tmp
<Current directory>\$dpx$.tmp\9fb14a648f4c094b96719806002d57b3.tmp
<Current directory>\$dpx$.tmp\6b7c23f9d60087449eec04334968862f.tmp
<Current directory>\$dpx$.tmp\3c35ce7c11e08a4f9406d0f3d2c5fcef.tmp
<Current directory>\$dpx$.tmp\55c404ddec132746887378a7aaa0efe4.tmp
<Current directory>\$dpx$.tmp\64d74b03e75cbd46823e9f8e83202734.tmp
<Current directory>\$dpx$.tmp\a7630e49fbbc134f9755a468c76532a4.tmp
<Current directory>\$dpx$.tmp\0c59fd429a83ab4db709ba5ba98bf664.tmp
<Current directory>\$dpx$.tmp\509e9daf6102f14c9c01bda1747934ff.tmp
<Current directory>\$dpx$.tmp\d299d93f524a4043b9217c0cb6fc035b.tmp
<Current directory>\$dpx$.tmp\2db3f2a99ff81b418df575e36a9227c0.tmp
<Current directory>\$dpx$.tmp\e22d306f4f87b240b3dd0097f9180bc8.tmp
<Current directory>\$dpx$.tmp\62729ebc1090c74ab80fcd753ffd0e4a.tmp
<Current directory>\$dpx$.tmp\2ee4d5f449425a409f7ff154c75289e4.tmp
<Current directory>\$dpx$.tmp\cf8adb683dc72a489906ac9da5564768.tmp
<Current directory>\$dpx$.tmp\d228ec9342412e48813e539835027dc7.tmp
<Current directory>\$dpx$.tmp\c0567ba98a9c4e4eab1f2ab92f40881b.tmp
<Current directory>\$dpx$.tmp\a6aa8560f5021746b8d7d52500c47f01.tmp
<Current directory>\$dpx$.tmp\432c991865bf7a4ab2c9b736d4c7ceff.tmp
<Current directory>\$dpx$.tmp\d2c61ebf15041349bf8dc054e55133fc.tmp
<Current directory>\$dpx$.tmp\018781e5afb95e4289ed2ef42b92322b.tmp
<Current directory>\$dpx$.tmp\80c35ce998854746b6684e8c4b7fb1cd.tmp
<Current directory>\$dpx$.tmp\092d249d43e7a34a8814a7ae5f2454df.tmp
<Current directory>\$dpx$.tmp\4177ac0bdc57a740993a330f042883b8.tmp
<Current directory>\$dpx$.tmp\bb8f6e8614deb145a0755cffe4959ece.tmp
<Current directory>\$dpx$.tmp\fe3d8395ac5eff4b87a81e68caba2a21.tmp
<Current directory>\$dpx$.tmp\0697e7463febe64aa3cf4bcda20a77b1.tmp
<Current directory>\$dpx$.tmp\2f5cbcc3a019bc4a84119d6d6e0fd456.tmp
<Current directory>\$dpx$.tmp\2f363adce880af4692a63f9c07ef8e1c.tmp
<Current directory>\$dpx$.tmp\d232cf95bf59944892cf2c2eeef2518b.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\d299d93f524a4043b9217c0cb6fc035b.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f51a3fd12a13e94499face1f50839fa7.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2c44169388298d4390f0135cd81bea0f.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f8e0e5a1936b8648919e2930d012f42d.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0794a897f280e842b1d46d1706c01d14.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2c184abd203c96478ea5150dc85787cd.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\29723e1393d5104680e265c334361ab1.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\21c4322c5a5c2045ad865d64bff13aff.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2c13d9667006a0488f81524faf0293aa.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\22cf107a0dac8249a7a9a6e9fc6ff94f.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\98dccd60f1820d40beaf0b2a5fc7ae01.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a584594fd0dd57498d738a2742a2fdd7.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\aa54af015afb774891032da459fdf940.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cf10e97f65adce44b3598b51b76b02ed.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9fb14a648f4c094b96719806002d57b3.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6b7c23f9d60087449eec04334968862f.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3c35ce7c11e08a4f9406d0f3d2c5fcef.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\55c404ddec132746887378a7aaa0efe4.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\c6e43e832b2b6f48ae812b488c9c29ef.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fec4c87b1f1dcd4995267b6b57f360a4.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\64d74b03e75cbd46823e9f8e83202734.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0c59fd429a83ab4db709ba5ba98bf664.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\2f363adce880af4692a63f9c07ef8e1c.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e22d306f4f87b240b3dd0097f9180bc8.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\62729ebc1090c74ab80fcd753ffd0e4a.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2ee4d5f449425a409f7ff154c75289e4.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cf8adb683dc72a489906ac9da5564768.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\d228ec9342412e48813e539835027dc7.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\c0567ba98a9c4e4eab1f2ab92f40881b.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a6aa8560f5021746b8d7d52500c47f01.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\432c991865bf7a4ab2c9b736d4c7ceff.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2db3f2a99ff81b418df575e36a9227c0.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d2c61ebf15041349bf8dc054e55133fc.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\80c35ce998854746b6684e8c4b7fb1cd.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\092d249d43e7a34a8814a7ae5f2454df.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4177ac0bdc57a740993a330f042883b8.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bb8f6e8614deb145a0755cffe4959ece.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fe3d8395ac5eff4b87a81e68caba2a21.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\0697e7463febe64aa3cf4bcda20a77b1.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2f5cbcc3a019bc4a84119d6d6e0fd456.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\509e9daf6102f14c9c01bda1747934ff.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\018781e5afb95e4289ed2ef42b92322b.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\a7630e49fbbc134f9755a468c76532a4.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\d232cf95bf59944892cf2c2eeef2518b.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней