Trojan.DownLoader33.15583

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\c9f7a9da42b8b24abaceacf9ced7de30.tmp
<Current directory>\$dpx$.tmp\81b76ada0f551a4a9d960eb7e7c5b791.tmp
<Current directory>\$dpx$.tmp\3349ae622ff83d40861335f90b1d3aa6.tmp
<Current directory>\$dpx$.tmp\27cdc0661610944882c241ea1592ea5d.tmp
<Current directory>\$dpx$.tmp\e184586f74cc8f499d423815a20ee294.tmp
<Current directory>\$dpx$.tmp\a293b206b80f0348bfc6fba4776df925.tmp
<Current directory>\$dpx$.tmp\e667e9a002c33244a65e10d708f9f1ec.tmp
<Current directory>\$dpx$.tmp\682254cee3782c4894aac3153e8f462f.tmp
<Current directory>\$dpx$.tmp\2ada8f2045b7994ca246a7df544f8a1e.tmp
<Current directory>\$dpx$.tmp\86f714056cfb6a448d2e5971cfb71ee7.tmp
<Current directory>\$dpx$.tmp\97c67479285ac94c9be6fbbcb20705a9.tmp
<Current directory>\$dpx$.tmp\37fd344cace3e446a9663bfd984841b9.tmp
<Current directory>\$dpx$.tmp\b125c70bc9a2b44eba971a8f4d3772a0.tmp
<Current directory>\$dpx$.tmp\dc43be82a5b02748b268ff76892ac68b.tmp
<Current directory>\$dpx$.tmp\bd179c851c87a044913b8b1eb635eb65.tmp
<Current directory>\$dpx$.tmp\5899c7e8004d394d914942ada8f16c03.tmp
<Current directory>\$dpx$.tmp\4d03ed017d35a74b94d4d379c2030347.tmp
<Current directory>\$dpx$.tmp\bb3d7c2c6c46b74ebdebadc89474e5a5.tmp
<Current directory>\$dpx$.tmp\885b8fbd627f064287c54d366c722267.tmp
<Current directory>\$dpx$.tmp\2883b1a7ba73fa408541f54a04f3de15.tmp
<Current directory>\$dpx$.tmp\52dc5bdaf2129845b5d7965bf3c43bae.tmp
<Current directory>\$dpx$.tmp\1e49f657fe64314284675ef802efa52e.tmp
<Current directory>\$dpx$.tmp\a6472b8e44d31d428745c4cf86157855.tmp
<Current directory>\$dpx$.tmp\f15b84e71c222c4d91b01c977f7549ef.tmp
<Current directory>\$dpx$.tmp\b3dfa20fd40c6540a126c86ca586d2a2.tmp
<Current directory>\$dpx$.tmp\ce733628896d2c4f98a7cef5c4c2361c.tmp
<Current directory>\$dpx$.tmp\fb04e612993daa4b85d0c0747ed31b68.tmp
<Current directory>\$dpx$.tmp\f50cd57f64aa554789722e22c1f0d455.tmp
<Current directory>\$dpx$.tmp\a67f3f88567f2a48aff71de8b374be0a.tmp
<Current directory>\$dpx$.tmp\e4fdb53fbb14f148be2f933990194398.tmp
<Current directory>\$dpx$.tmp\cddd1327e6807a4cac8cc3b5751baa11.tmp
<Current directory>\$dpx$.tmp\78430b86656c67418cd61a8a0e0154d7.tmp
<Current directory>\$dpx$.tmp\c21f00daef9d8b43a8106ad25ad80c5d.tmp
<Current directory>\$dpx$.tmp\7581e596b27cf24e87184695db20f5a5.tmp
<Current directory>\$dpx$.tmp\38853ba02a09154ead189541e762d64c.tmp
<Current directory>\$dpx$.tmp\1f74b5b89741a440a734a8ec0841ed60.tmp
<Current directory>\$dpx$.tmp\bd80c6b02d6fee40ada4342999d2f57d.tmp
<Current directory>\$dpx$.tmp\63da0c406a15ed4fb157f45f4580d3c0.tmp
<Current directory>\$dpx$.tmp\c288df5ea7c00d439520be3d022a0e32.tmp
<Current directory>\$dpx$.tmp\b922d1cdcd25de48be04026ae424f325.tmp
<Current directory>\$dpx$.tmp\7e55500ab9a8004e87543cb51385296c.tmp
<Current directory>\$dpx$.tmp\b0cfdbb4491d0e48afa28631d3547874.tmp
<Current directory>\$dpx$.tmp\f2106fe11a328e478a9a8e1854fcab43.tmp
<Current directory>\$dpx$.tmp\5a9691e517386d4fbac5bd9840d9680c.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\f15b84e71c222c4d91b01c977f7549ef.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3349ae622ff83d40861335f90b1d3aa6.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\27cdc0661610944882c241ea1592ea5d.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e184586f74cc8f499d423815a20ee294.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a293b206b80f0348bfc6fba4776df925.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e667e9a002c33244a65e10d708f9f1ec.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\682254cee3782c4894aac3153e8f462f.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2ada8f2045b7994ca246a7df544f8a1e.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c9f7a9da42b8b24abaceacf9ced7de30.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\81b76ada0f551a4a9d960eb7e7c5b791.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\86f714056cfb6a448d2e5971cfb71ee7.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b125c70bc9a2b44eba971a8f4d3772a0.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\dc43be82a5b02748b268ff76892ac68b.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bd179c851c87a044913b8b1eb635eb65.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5899c7e8004d394d914942ada8f16c03.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4d03ed017d35a74b94d4d379c2030347.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bb3d7c2c6c46b74ebdebadc89474e5a5.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\885b8fbd627f064287c54d366c722267.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\97c67479285ac94c9be6fbbcb20705a9.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\37fd344cace3e446a9663bfd984841b9.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2883b1a7ba73fa408541f54a04f3de15.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1e49f657fe64314284675ef802efa52e.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\f2106fe11a328e478a9a8e1854fcab43.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ce733628896d2c4f98a7cef5c4c2361c.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fb04e612993daa4b85d0c0747ed31b68.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f50cd57f64aa554789722e22c1f0d455.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a67f3f88567f2a48aff71de8b374be0a.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\e4fdb53fbb14f148be2f933990194398.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\cddd1327e6807a4cac8cc3b5751baa11.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\78430b86656c67418cd61a8a0e0154d7.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c21f00daef9d8b43a8106ad25ad80c5d.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b3dfa20fd40c6540a126c86ca586d2a2.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7581e596b27cf24e87184695db20f5a5.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1f74b5b89741a440a734a8ec0841ed60.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bd80c6b02d6fee40ada4342999d2f57d.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\63da0c406a15ed4fb157f45f4580d3c0.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c288df5ea7c00d439520be3d022a0e32.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b922d1cdcd25de48be04026ae424f325.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\7e55500ab9a8004e87543cb51385296c.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b0cfdbb4491d0e48afa28631d3547874.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a6472b8e44d31d428745c4cf86157855.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\38853ba02a09154ead189541e762d64c.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\52dc5bdaf2129845b5d7965bf3c43bae.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\5a9691e517386d4fbac5bd9840d9680c.tmp to <Current directory>\vcruntime140.dll

Network activity

Connects to

'lp##.beahh.com':443
'lp##.haqo.net':443

TCP

'lp##.abbny.com':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней