Trojan.DownLoader33.15590

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\89de99ea12a15a46a09c705490148241.tmp
<Current directory>\$dpx$.tmp\798b01ae01077f488f1e9bd09cedf909.tmp
<Current directory>\$dpx$.tmp\4c526065d650b34ead28f38b9f4ac8a0.tmp
<Current directory>\$dpx$.tmp\a2e1b27a83599c41bc544a6edbdc07c7.tmp
<Current directory>\$dpx$.tmp\438a4a10ae9d40429ac34e0d5437b3e4.tmp
<Current directory>\$dpx$.tmp\72bf987d261efe49be0c53e1190ce002.tmp
<Current directory>\$dpx$.tmp\f7f5d6af77260645b012c30931b0d59d.tmp
<Current directory>\$dpx$.tmp\ed79b5ee40871a498d7aca7a241c7188.tmp
<Current directory>\$dpx$.tmp\e01fcefb0d63124cb63a1e7f795eb514.tmp
<Current directory>\$dpx$.tmp\159926d93601ae4ea57ef8cf4f63d571.tmp
<Current directory>\$dpx$.tmp\5fba6b3d016b4f4c84d7210bbbebfe52.tmp
<Current directory>\$dpx$.tmp\38769a6583fc1648b427674f1170d6fa.tmp
<Current directory>\$dpx$.tmp\4035d1441f4aa349a6a476e49e9bbb26.tmp
<Current directory>\$dpx$.tmp\f037c9d516065645ae674d64108aba9d.tmp
<Current directory>\$dpx$.tmp\b6924c68694ef945b8bd3cfcb88df0be.tmp
<Current directory>\$dpx$.tmp\362ced5caaeb8147b51afdf5c0f48f42.tmp
<Current directory>\$dpx$.tmp\0c25564798da2e40a3b7b421f64167a1.tmp
<Current directory>\$dpx$.tmp\21e600d74cf39d44b5ffaa1c027a25bc.tmp
<Current directory>\$dpx$.tmp\9447dd36f9d54149b8776db46b85a983.tmp
<Current directory>\$dpx$.tmp\4c5819cd36e6964f9c8b36dd618d2030.tmp
<Current directory>\$dpx$.tmp\796ef9735073724a9127459b62c21521.tmp
<Current directory>\$dpx$.tmp\ec7a5318ae9ef24a81d8a00c02032fce.tmp
<Current directory>\$dpx$.tmp\b2aee4a131ef82488c6d2ebe172fca58.tmp
<Current directory>\$dpx$.tmp\f24f2ac6be3802429f819a85bfc9fa83.tmp
<Current directory>\$dpx$.tmp\38c054bcef979c4faebb3c92eca18671.tmp
<Current directory>\$dpx$.tmp\34c1a74b9c773345925ff979d63d57a8.tmp
<Current directory>\$dpx$.tmp\472624ecc4a61f40ab4f9378f8fe98d3.tmp
<Current directory>\$dpx$.tmp\11b83cb49117804ea8109b5440d60c03.tmp
<Current directory>\$dpx$.tmp\cee3df5fae30444d8707d35bc13295be.tmp
<Current directory>\$dpx$.tmp\ac977280eee6bc4a9b2fbd2f70b5f19f.tmp
<Current directory>\$dpx$.tmp\ce98af5f4bb52b4b88f2f697f0215610.tmp
<Current directory>\$dpx$.tmp\1f77527f6dc8e84d866db401b534950d.tmp
<Current directory>\$dpx$.tmp\c7ff5899fca03f4488167184ab22d371.tmp
<Current directory>\$dpx$.tmp\9b38c4ca125b70489440e237067e4b7e.tmp
<Current directory>\$dpx$.tmp\8b547c4ee75f5b49a68122092c87de98.tmp
<Current directory>\$dpx$.tmp\73e390eb29e7d445a533f3780d11cdc6.tmp
<Current directory>\$dpx$.tmp\64c14c5cc6232e42aa83241f5ceeec76.tmp
<Current directory>\$dpx$.tmp\5d1fe264b2fe074cb3235e924c152fa3.tmp
<Current directory>\$dpx$.tmp\237ce58cf147ab469d7078b52e4145c5.tmp
<Current directory>\$dpx$.tmp\50fe60eb49d15e4ca4867e1eb66c4ad8.tmp
<Current directory>\$dpx$.tmp\eeb8e16cdc836846957e47079b622ddb.tmp
<Current directory>\$dpx$.tmp\78c1ffb1a4a3364daa996381faadf402.tmp
<Current directory>\$dpx$.tmp\5d2a9d4d3ba0b14282ff868ba9bb7cbd.tmp
<Current directory>\$dpx$.tmp\7913ce0e29319a4ebb1dc93179743af3.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\f24f2ac6be3802429f819a85bfc9fa83.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4c526065d650b34ead28f38b9f4ac8a0.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a2e1b27a83599c41bc544a6edbdc07c7.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\438a4a10ae9d40429ac34e0d5437b3e4.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\72bf987d261efe49be0c53e1190ce002.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f7f5d6af77260645b012c30931b0d59d.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ed79b5ee40871a498d7aca7a241c7188.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e01fcefb0d63124cb63a1e7f795eb514.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\89de99ea12a15a46a09c705490148241.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\798b01ae01077f488f1e9bd09cedf909.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\159926d93601ae4ea57ef8cf4f63d571.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4035d1441f4aa349a6a476e49e9bbb26.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f037c9d516065645ae674d64108aba9d.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b6924c68694ef945b8bd3cfcb88df0be.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\362ced5caaeb8147b51afdf5c0f48f42.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0c25564798da2e40a3b7b421f64167a1.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\21e600d74cf39d44b5ffaa1c027a25bc.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\9447dd36f9d54149b8776db46b85a983.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\5fba6b3d016b4f4c84d7210bbbebfe52.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\38769a6583fc1648b427674f1170d6fa.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4c5819cd36e6964f9c8b36dd618d2030.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ec7a5318ae9ef24a81d8a00c02032fce.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\5d2a9d4d3ba0b14282ff868ba9bb7cbd.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\34c1a74b9c773345925ff979d63d57a8.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\472624ecc4a61f40ab4f9378f8fe98d3.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\11b83cb49117804ea8109b5440d60c03.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cee3df5fae30444d8707d35bc13295be.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\ac977280eee6bc4a9b2fbd2f70b5f19f.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\ce98af5f4bb52b4b88f2f697f0215610.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1f77527f6dc8e84d866db401b534950d.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c7ff5899fca03f4488167184ab22d371.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\38c054bcef979c4faebb3c92eca18671.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9b38c4ca125b70489440e237067e4b7e.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\73e390eb29e7d445a533f3780d11cdc6.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\64c14c5cc6232e42aa83241f5ceeec76.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5d1fe264b2fe074cb3235e924c152fa3.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\237ce58cf147ab469d7078b52e4145c5.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\50fe60eb49d15e4ca4867e1eb66c4ad8.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\eeb8e16cdc836846957e47079b622ddb.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\78c1ffb1a4a3364daa996381faadf402.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b2aee4a131ef82488c6d2ebe172fca58.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8b547c4ee75f5b49a68122092c87de98.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\796ef9735073724a9127459b62c21521.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\7913ce0e29319a4ebb1dc93179743af3.tmp to <Current directory>\vcruntime140.dll

Network activity

TCP

'lp##.abbny.com':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней