Trojan.DownLoader33.15579

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\f9081937c3ca3044b69dc8dfe3f75443.tmp
<Current directory>\$dpx$.tmp\d3c3a9e1d3767e45b877efac693e22e7.tmp
<Current directory>\$dpx$.tmp\9eaca86d16b8d74796e943a8a99a81cf.tmp
<Current directory>\$dpx$.tmp\e4741bb5a350e040913408bdb5133790.tmp
<Current directory>\$dpx$.tmp\267256c9bcb7e94884c7b3fca41d3492.tmp
<Current directory>\$dpx$.tmp\c875f5821d38584680d2efdf05a07486.tmp
<Current directory>\$dpx$.tmp\6c420b2e473f7b4089f629ad9370f8fd.tmp
<Current directory>\$dpx$.tmp\5b495b92502a14498b584c270e51c89a.tmp
<Current directory>\$dpx$.tmp\3b47966d00bcc344a33e1799ee8e2913.tmp
<Current directory>\$dpx$.tmp\f9adf99b4f14054c92cdb80e9605f3c2.tmp
<Current directory>\$dpx$.tmp\361dbf5d4ff0d3408bb5e9cd4c710d6a.tmp
<Current directory>\$dpx$.tmp\a43bd6cce021ce429beef7dc571aeb11.tmp
<Current directory>\$dpx$.tmp\987eb967c1c01b448c7bfd753cb94fab.tmp
<Current directory>\$dpx$.tmp\a811b2e02125134598803e69de880127.tmp
<Current directory>\$dpx$.tmp\563f656fdbdb4f43b8cf2c2d2086dde0.tmp
<Current directory>\$dpx$.tmp\1d7b332dd7e2024c95cdeb6c931e40bb.tmp
<Current directory>\$dpx$.tmp\725e73865e58c24dae8807ed6f39ea32.tmp
<Current directory>\$dpx$.tmp\217863c3d4955b4a90e187c26e7372bf.tmp
<Current directory>\$dpx$.tmp\675019efd4ebaf418b4e2ebe33eaf423.tmp
<Current directory>\$dpx$.tmp\9b40230f85151d49a406d97e0f3460d2.tmp
<Current directory>\$dpx$.tmp\86cddf450582cd46b1da5d33abab410a.tmp
<Current directory>\$dpx$.tmp\3e331e16ed47f34ca3e6484667e3337e.tmp
<Current directory>\$dpx$.tmp\dd176fbd8e6f5241ae2dad97513b423c.tmp
<Current directory>\$dpx$.tmp\fc31ed7f492b44409545881f461c0244.tmp
<Current directory>\$dpx$.tmp\d6fe68a6e82be645a45d696162a4cdf8.tmp
<Current directory>\$dpx$.tmp\44ec406f0d6c464383d677b1f3fd1b47.tmp
<Current directory>\$dpx$.tmp\ad570c0a855a574481a68e443480cc38.tmp
<Current directory>\$dpx$.tmp\346d577b72fd514fb4f9194250191c82.tmp
<Current directory>\$dpx$.tmp\d8702457f4d5ba4bb37a2c1339358ced.tmp
<Current directory>\$dpx$.tmp\218b169a71dfa94e8184b98660faf323.tmp
<Current directory>\$dpx$.tmp\0f3acec2f4e90245b0086ef130edd8bd.tmp
<Current directory>\$dpx$.tmp\9b9fd7703c792a4ea3129865216a38de.tmp
<Current directory>\$dpx$.tmp\cd449b919f99f148b124292eda6bd5e6.tmp
<Current directory>\$dpx$.tmp\1273f2a39e0de94a85acdd89bf3a7edd.tmp
<Current directory>\$dpx$.tmp\735b9dba68051e4e85c9a5561a57ab79.tmp
<Current directory>\$dpx$.tmp\5402ad6f66c8d04d89a102ea231ca072.tmp
<Current directory>\$dpx$.tmp\571102f8ee4a09439dcb3003598b8a3b.tmp
<Current directory>\$dpx$.tmp\fe8d77742012254ebf0f159fd0fc09e6.tmp
<Current directory>\$dpx$.tmp\ca649285ef93794280bd2cf9258a2919.tmp
<Current directory>\$dpx$.tmp\e305a43c5595b54eac3c4108fa5fbfa8.tmp
<Current directory>\$dpx$.tmp\5dfbfecbfa7bee4899faee5f55f954ee.tmp
<Current directory>\$dpx$.tmp\29a9691f85fbdf49aeb73f6cf9e7b7a8.tmp
<Current directory>\$dpx$.tmp\8adb803016b66b49a1558e3ef66ca315.tmp
<Current directory>\$dpx$.tmp\561f093803c60d46a0e50201e031ebf9.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\fc31ed7f492b44409545881f461c0244.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9eaca86d16b8d74796e943a8a99a81cf.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e4741bb5a350e040913408bdb5133790.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\267256c9bcb7e94884c7b3fca41d3492.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c875f5821d38584680d2efdf05a07486.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6c420b2e473f7b4089f629ad9370f8fd.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5b495b92502a14498b584c270e51c89a.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3b47966d00bcc344a33e1799ee8e2913.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f9081937c3ca3044b69dc8dfe3f75443.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d3c3a9e1d3767e45b877efac693e22e7.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f9adf99b4f14054c92cdb80e9605f3c2.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\987eb967c1c01b448c7bfd753cb94fab.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a811b2e02125134598803e69de880127.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\563f656fdbdb4f43b8cf2c2d2086dde0.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1d7b332dd7e2024c95cdeb6c931e40bb.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\725e73865e58c24dae8807ed6f39ea32.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\217863c3d4955b4a90e187c26e7372bf.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\675019efd4ebaf418b4e2ebe33eaf423.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\361dbf5d4ff0d3408bb5e9cd4c710d6a.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a43bd6cce021ce429beef7dc571aeb11.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9b40230f85151d49a406d97e0f3460d2.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3e331e16ed47f34ca3e6484667e3337e.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\8adb803016b66b49a1558e3ef66ca315.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\44ec406f0d6c464383d677b1f3fd1b47.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ad570c0a855a574481a68e443480cc38.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\346d577b72fd514fb4f9194250191c82.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d8702457f4d5ba4bb37a2c1339358ced.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\218b169a71dfa94e8184b98660faf323.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\0f3acec2f4e90245b0086ef130edd8bd.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9b9fd7703c792a4ea3129865216a38de.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cd449b919f99f148b124292eda6bd5e6.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d6fe68a6e82be645a45d696162a4cdf8.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1273f2a39e0de94a85acdd89bf3a7edd.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5402ad6f66c8d04d89a102ea231ca072.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\571102f8ee4a09439dcb3003598b8a3b.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fe8d77742012254ebf0f159fd0fc09e6.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ca649285ef93794280bd2cf9258a2919.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e305a43c5595b54eac3c4108fa5fbfa8.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\5dfbfecbfa7bee4899faee5f55f954ee.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\29a9691f85fbdf49aeb73f6cf9e7b7a8.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\dd176fbd8e6f5241ae2dad97513b423c.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\735b9dba68051e4e85c9a5561a57ab79.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\86cddf450582cd46b1da5d33abab410a.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\561f093803c60d46a0e50201e031ebf9.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней