Trojan.DownLoader33.15581

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\d799e0d3ea5c8947828ce48a4dd88259.tmp
<Current directory>\$dpx$.tmp\5178f13627c14642bda72adf8192ab5d.tmp
<Current directory>\$dpx$.tmp\ff9f7b57af773c4693fc0efafcf122f1.tmp
<Current directory>\$dpx$.tmp\2f98ac0adb7c39469b4025c30a74ee57.tmp
<Current directory>\$dpx$.tmp\e376d25d8ac5f24f9da05c4177bc1e10.tmp
<Current directory>\$dpx$.tmp\525922e66920f34399035efcd6929a94.tmp
<Current directory>\$dpx$.tmp\cd300d21dfcbad4a9c6d12689f922e55.tmp
<Current directory>\$dpx$.tmp\1fc70954d15307449e7e96b6ada6fb96.tmp
<Current directory>\$dpx$.tmp\be84cc7c8778b7488c48c19a3698c77d.tmp
<Current directory>\$dpx$.tmp\8a6bdb13f0b47d4f914c47f467ba165b.tmp
<Current directory>\$dpx$.tmp\2aba860f5f604245bd8cb3a352a0130b.tmp
<Current directory>\$dpx$.tmp\d17f144c61fc0247808be05b3f236cb9.tmp
<Current directory>\$dpx$.tmp\86ea75cff4690b46877e5d1f6a86343e.tmp
<Current directory>\$dpx$.tmp\ad7c7e1e4db0c3468f64377cdaee8323.tmp
<Current directory>\$dpx$.tmp\bd8dfb178401c34f90c9262d3ccd6f1b.tmp
<Current directory>\$dpx$.tmp\3c5a9eb9ea546b4a91d85c67dc3c38fd.tmp
<Current directory>\$dpx$.tmp\bd7ee17a6ccd8848ba929461adc84a34.tmp
<Current directory>\$dpx$.tmp\356a4ff02bde8a4bbbf79c7370e82e34.tmp
<Current directory>\$dpx$.tmp\975986f3fd073a48b59edb7c805027eb.tmp
<Current directory>\$dpx$.tmp\052bc3137503a74da259bd96c16430fe.tmp
<Current directory>\$dpx$.tmp\121f1406c39e0b49a5d8c5f9b1be7e6e.tmp
<Current directory>\$dpx$.tmp\ba628a91a2315c40ae34c43493092b1d.tmp
<Current directory>\$dpx$.tmp\71e4372af12d794dae64b9d356cf72ca.tmp
<Current directory>\$dpx$.tmp\40229ca3d3b0eb43af1f96ad1e2a22e3.tmp
<Current directory>\$dpx$.tmp\f1792ccf2d733640911a8e1219c195a3.tmp
<Current directory>\$dpx$.tmp\6bf8fe827bbd964e878542de04019045.tmp
<Current directory>\$dpx$.tmp\28236c05f6e1c64bb85393a138c6a1fb.tmp
<Current directory>\$dpx$.tmp\e507bd5e9cac0047b14f95cd666f7ce1.tmp
<Current directory>\$dpx$.tmp\dc7bbb85c388ba4788e8d251447bfe5f.tmp
<Current directory>\$dpx$.tmp\324aba4e524c7a42a6c03e89dcb08687.tmp
<Current directory>\$dpx$.tmp\9d759ca5403e12448c20708f9a8e66cc.tmp
<Current directory>\$dpx$.tmp\0c41eb54641429439431d8b804e09ed2.tmp
<Current directory>\$dpx$.tmp\f959bad864829a4faea015f9153d1a16.tmp
<Current directory>\$dpx$.tmp\058b578257ef284c9164531273d03e59.tmp
<Current directory>\$dpx$.tmp\eb4269895ac4da4aadc3d8e5760794af.tmp
<Current directory>\$dpx$.tmp\4c7c74192a59f0439ab5100331348d41.tmp
<Current directory>\$dpx$.tmp\96f050436dbcc143bc473733d2104302.tmp
<Current directory>\$dpx$.tmp\bca93774f1940c4797c297ffb115c387.tmp
<Current directory>\$dpx$.tmp\94cc77c8b0fd844c969ee739c729d411.tmp
<Current directory>\$dpx$.tmp\f9cf653711698d4d98dfe60984666c8c.tmp
<Current directory>\$dpx$.tmp\93ef5ac05b068343b91c027f0cd39137.tmp
<Current directory>\$dpx$.tmp\b06e4d54a662274bbf24b44e563ed111.tmp
<Current directory>\$dpx$.tmp\61a482c46a5e9b44b044f2d3bbbf99de.tmp
<Current directory>\$dpx$.tmp\81c955c70d8bd444a048338e2413ac83.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\40229ca3d3b0eb43af1f96ad1e2a22e3.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ff9f7b57af773c4693fc0efafcf122f1.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2f98ac0adb7c39469b4025c30a74ee57.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e376d25d8ac5f24f9da05c4177bc1e10.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\525922e66920f34399035efcd6929a94.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cd300d21dfcbad4a9c6d12689f922e55.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1fc70954d15307449e7e96b6ada6fb96.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\be84cc7c8778b7488c48c19a3698c77d.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d799e0d3ea5c8947828ce48a4dd88259.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5178f13627c14642bda72adf8192ab5d.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8a6bdb13f0b47d4f914c47f467ba165b.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\86ea75cff4690b46877e5d1f6a86343e.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ad7c7e1e4db0c3468f64377cdaee8323.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bd8dfb178401c34f90c9262d3ccd6f1b.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3c5a9eb9ea546b4a91d85c67dc3c38fd.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bd7ee17a6ccd8848ba929461adc84a34.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\356a4ff02bde8a4bbbf79c7370e82e34.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\975986f3fd073a48b59edb7c805027eb.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\2aba860f5f604245bd8cb3a352a0130b.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d17f144c61fc0247808be05b3f236cb9.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\052bc3137503a74da259bd96c16430fe.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ba628a91a2315c40ae34c43493092b1d.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\61a482c46a5e9b44b044f2d3bbbf99de.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6bf8fe827bbd964e878542de04019045.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\28236c05f6e1c64bb85393a138c6a1fb.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e507bd5e9cac0047b14f95cd666f7ce1.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\dc7bbb85c388ba4788e8d251447bfe5f.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\324aba4e524c7a42a6c03e89dcb08687.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\9d759ca5403e12448c20708f9a8e66cc.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0c41eb54641429439431d8b804e09ed2.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f959bad864829a4faea015f9153d1a16.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f1792ccf2d733640911a8e1219c195a3.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\058b578257ef284c9164531273d03e59.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4c7c74192a59f0439ab5100331348d41.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\96f050436dbcc143bc473733d2104302.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bca93774f1940c4797c297ffb115c387.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\94cc77c8b0fd844c969ee739c729d411.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f9cf653711698d4d98dfe60984666c8c.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\93ef5ac05b068343b91c027f0cd39137.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b06e4d54a662274bbf24b44e563ed111.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\71e4372af12d794dae64b9d356cf72ca.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\eb4269895ac4da4aadc3d8e5760794af.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\121f1406c39e0b49a5d8c5f9b1be7e6e.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\81c955c70d8bd444a048338e2413ac83.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней